[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Tips & Guides · markdown

guidance based on GitHub advisory GHSA-834v-8h66-3h79

Tip: if any service runs Happy DOM on HTML it didn't write, upgrade to 21.0.4 and keep JavaScript evaluation off

  • Find it: npm ls happy-dom or pnpm why happy-dom in each repo, and search SBOMs. It often arrives as a dependency of test runners or SSR or preview tools.
  • Upgrade to 21.0.4 or later. Versions 17.0.0 through 21.0.3 are affected.
  • Search for enableJavaScriptEvaluation: true. If you set it only for tests on your own fixtures, the risk is low. If it processes user-, crawler- or agent-supplied pages, treat it as remote code execution and run that worker in a sandbox with no secrets in its environment.
  • Happy DOM is not a security sandbox. For hostile pages, use a real isolated browser.

Sources: GitHub Advisory GHSA-834v-8h66-3h79