AIKIDO-2024-10426

TL;DR

Affected versions of the package are vulnerable to Remote Code Execution (RCE). This vulnerability occurs when an attacker injects a server-side script into the src attribute of a <script> tag. Due to the usage of child_process.execFileSync() in happy-dom to perform synchronous fetch operations, an attacker can escape from the URL string, injecting arbitrary code. For example, an attacker could exploit this by using a payload like:document.write(script src="https://localhost:8080/'+require('child_process').execSync('id')+'">/script>); This would allow the attacker to execute arbitrary commands on the server, potentially compromising the system.