---
title: "CVE-2025-61927: Happy DOM: VM Context Escape can lead to Remote Code Execution"
url: https://erroneo.us/security/cve/CVE-2025-61927/
description: "CVE-2025-61927 (happy-dom (npm)): Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Happy DOM v19 and lower…"
type: vulnerability-record
section: "Security Digest"
date_published: 2025-10-10
date_modified: 2025-10-13
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2025-61927"
kev: false
cvss: 7.2
epss: 0.00642
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2025-61927: Happy DOM: VM Context Escape can lead to Remote Code Execution

**Signal:** Normal patch cycle. No exploitation signal; fix it in your next routine update if you are affected. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Not in CISA KEV , but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 0.6% , percentile 50: FIRST’s model estimates a 0.6% chance of exploitation activity in the next 30 days, higher than 50% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
- Needs an account (high (admin)). Exposure depends on who can log in.
- Only applies if your dependency tree includes happy-dom (npm) < 20.0.0, fixed in 20.0.0 . Check your lockfile, including transitive dependencies.

## What it is

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Happy DOM v19 and lower contains a security vulnerability that puts the owner system at the risk of RCE (Remote Code Execution) attacks. A Node.js VM Context is not an isolated environment, and if the user runs untrusted JavaScript code within the Happy DOM VM Context, it may escape the VM and get access to process level functionality. It seems like what the attacker can get control over depends on if the process is using ESM or CommonJS. With CommonJS the attacker can get hold of the require() function to import modules. Happy DOM has JavaScript evaluation enabled by default. This may not be obvious to the consumer of Happy DOM and can potentially put the user at risk if untrusted code is executed within the environment. Version 20.0.0 patches the issue by changing JavaScript evaluation to be disabled by default.

## Affected packages

- npm `happy-dom` < 20.0.0 → fixed: 20.0.0

## Affected products (CVE record)

- capricorn86 happy-dom: < 20.0.0

## Severity

- GitHub_M CVSS 4.0: 7.2 `CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H`
- GitHub CVSS 4.0: 9.3 `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc , automatable no , technical impact partial .
- FIRST EPSS (model of 2026-10-21): 0.64% probability of exploitation activity in the next 30 days; percentile 50.

## Sources

- [GitHub Advisory GHSA-37j7-fg3j-429f](https://github.com/advisories/GHSA-37j7-fg3j-429f)
- [CVE.org record CVE-2025-61927](https://www.cve.org/CVERecord?id=CVE-2025-61927)
- [NVD entry CVE-2025-61927](https://nvd.nist.gov/vuln/detail/CVE-2025-61927)
- [github.com](https://github.com/capricorn86/happy-dom/security/advisories/GHSA-37j7-fg3j-429f)
- [github.com](https://github.com/capricorn86/happy-dom/commit/819d15ba289495439eda8be360d92a614ce22405)
- [github.com](https://github.com/capricorn86/happy-dom/commit/de438ad72921c69793584aa657b48d3655dfac97)
- [github.com](https://github.com/capricorn86/happy-dom/releases/tag/v20.0.0)

---
Source page: https://erroneo.us/security/cve/CVE-2025-61927/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt