Detections
Analytics

SCA: security update for happy-dom (GHSA-37j7-fg3j-429f)

high Tenable Cloud Security Plugin ID 435579

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Happy DOM
 v19 and lower contains a security vulnerability that puts the owner system at the risk of RCE (Remote Code
 Execution) attacks. A Node.js VM Context is not an isolated environment, and if the user runs untrusted
 JavaScript code within the Happy DOM VM Context, it may escape the VM and get access to process level
 functionality. It seems like what the attacker can get control over depends on if the process is using ESM
 or CommonJS. With CommonJS the attacker can get hold of the `require()` function to import modules. Happy
 DOM has JavaScript evaluation enabled by default. This may not be obvious to the consumer of Happy DOM and
 can potentially put the user at risk if untrusted code is executed within the environment. Version 20.0.0
 patches the issue by changing JavaScript evaluation to be disabled by default. (CVE-2025-61927)

See Also

https://github.com/advisories/GHSA-37j7-fg3j-429f

Plugin Details

Severity: High

ID: 435579

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 10/11/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.88

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2025-61927

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.2

Threat Score: 4

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/10/2025

Vulnerability Publication Date: 10/10/2025

Reference Information

CVE: CVE-2025-61927

cwe: CWE-94