CVE-2024-51757

happy-dom is a JavaScript implementation of a web browser without its graphical user interface. Versions of happy-dom prior to 15.10.2 may execute code on the host via a script tag. This would execute code in the user context of happy-dom. Users are advised to upgrade to version 15.10.2. There are no known workarounds for this vulnerability.

• CWE-79
• CWE-94

• https://github.com/capricorn86/happy-dom/commit/5ee0b1676d4ce20cc2a70d1c9c8d6f1e3f57efac
• https://github.com/capricorn86/happy-dom/commit/d23834c232f1cf5519c9418b073f1dcec6b2f0fd
• https://github.com/capricorn86/happy-dom/issues/1585
• https://github.com/capricorn86/happy-dom/pull/1586
• https://github.com/capricorn86/happy-dom/releases/tag/v15.10.2
• https://github.com/capricorn86/happy-dom/security/advisories/GHSA-96g7-g7g9-jxw8

Published

Nov 6, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-51751Gradio is an open-source Python package designed to enable q…6.5
• CVE-2024-51752The AuthKit library for Next.js provides convenient helpers …5.5
• CVE-2024-51753The AuthKit library for Remix provides convenient helpers fo…2.1
• CVE-2024-51754Twig is a template language for PHP. In a sandbox, an attack…2.2
• CVE-2024-51755Twig is a template language for PHP. In a sandbox, an attack…2.2
• CVE-2024-51756The cap-std project is organized around the eponymous `cap-s…2.3
• CVE-2024-51758Filament is a collection of full-stack components for accele…2.3
• CVE-2024-51759Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2024-5176Insufficiently Protected Credentials vulnerability in Baxter…9.4
• CVE-2024-51760Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2024-51761Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2024-51762Improper Neutralization of Input During Web Page Generation …7.1