{"action":"Upgrade happy-dom to 20.0.2 or later.","affected":[{"fixed":"20.0.2","introduced":"19.0.0"}],"component":"happy-dom","cve_ids":["CVE-2025-62410"],"ecosystem":"npm","epss":0.0036,"exploited":false,"fixed_versions":["20.0.2"],"ghsa_id":"GHSA-qpm2-6cq5-7pq5","id":"tcs_01M5KG6QM56N38TVE81W0NAGE7","modified_at":"2025-11-27T09:10:13.606901Z","published_at":"2025-10-15T20:29:04Z","references":["https://osv.dev/vulnerability/GHSA-qpm2-6cq5-7pq5","https://github.com/capricorn86/happy-dom/security/advisories/GHSA-qpm2-6cq5-7pq5","https://nvd.nist.gov/vuln/detail/CVE-2025-62410","https://github.com/capricorn86/happy-dom/commit/f4bd4ebe3fe5abd2be2bcea1c07043c8b0b70eea","https://github.com/capricorn86/happy-dom"],"severity":{"label":"critical","score":9.4},"sources":[{"source":"osv","source_id":"GHSA-qpm2-6cq5-7pq5","url":"https://osv.dev/vulnerability/GHSA-qpm2-6cq5-7pq5"},{"source":"nvd","source_id":"CVE-2025-62410","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62410"}],"summary":"happy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript"}