Critical severity · published Nov 6, 2024
CVE-2024-51757
Fixes security vulnerability that allowed for server side code to be executed by a <script> tag
9.3
CVSS
0.8%
EPSS
No
On KEV
Description
happy-dom is a JavaScript implementation of a web browser without its graphical user interface. Versions of happy-dom prior to 15.10.2 may execute code on the host via a script tag. This would execute code in the user context of happy-dom. Users are advised to upgrade to version 15.10.2. There are no known workarounds for this vulnerability.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
happy-dom · capricorn86
< 15.10.2 · source: vendor, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-51757
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-51757
github.com
https://github.com/capricorn86/happy-dom/commit/5ee0b1676d4ce20cc2a70d1c9c8d6f1e3f57efac
github.com
https://github.com/capricorn86/happy-dom/commit/d23834c232f1cf5519c9418b073f1dcec6b2f0fd
github.com
https://github.com/capricorn86/happy-dom/issues/1585
github.com
https://github.com/capricorn86/happy-dom/pull/1586
github.com
https://github.com/capricorn86/happy-dom/releases/tag/v15.10.2
github.com
https://github.com/capricorn86/happy-dom/security/advisories/GHSA-96g7-g7g9-jxw8
More from happy-dom
9.8
CVE-2026-33943
Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code
9.4
CVE-2025-62410
--disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom
8.8
CVE-2026-115895
Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
8.6
CVE-2026-118660
Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML
7.5
CVE-2026-118659
@happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy