Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading default to false. An attacker who controls parsed HTML can therefore cause server-side requests to arbitrary internal or cloud endpoints without an application opt-in and may expose confidential responses or credentials returned by those endpoints. This issue is fixed in version 21.0.0.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…py-dom/security/advisories/GHSA-c8p4-j97h-3vg8 Diğer
• github.com/capricorn86/happy-dom/pull/2502 Diğer
• github.com/…ommit/0a99c7525a1d0043e3182843ae33466ab7b19e74 Diğer
• github.com/capricorn86/happy-dom/releases/tag/v21.0.0 Diğer

Kayıt geçmişi

1. 28 Eki 2026 23:23Yayımlandı

İlgili açıklar

• 6,5 CVE-2026-118661Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies
• 7,5 CVE-2026-118659@happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy
• 8,8 CVE-2026-115895Happy DOM'da içe aktarma takma adı doğrulanmadığı için Node.js ana süreçte kod çalıştırma
• 7,7 CVE-2026-13451Kserve: kserve: server-side request forgery via malicious storageuri
• 4,7 CVE-2026-61529Endatix: Blind second-order SSRF via anonymous form-submission file URLs (`SubmissionFileExtractor`)
• 8,3 CVE-2025-14260Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources