Happy DOM, the browser emulator used by many JavaScript test runners and some SSR and scraping services, has a second code-injection path in its ES module compiler. It's an incomplete fix for CVE-2026-33943. A named-import alias isn't validated before it is pasted into generated code, so a crafted import { x as y = ... } runs attacker code. The reporter's PoC reached the host's process and node:fs and wrote to the host filesystem.

• Affected: happy-dom 17.0.0 through 21.0.3. Fixed: 21.0.4 (published to npm Oct 20; the advisory went public Oct 23).
• Precondition: enableJavaScriptEvaluation: true plus attacker-controlled HTML or module source. Unit tests on your own code are low risk. Services that render or preview pages supplied by users or agents are the real exposure.
• CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R).