ETK-2026-2206Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-2206",
  "cve_id": null,
  "display_id": "ETK-2026-2206",
  "ghsa_id": "GHSA-834v-8h66-3h79",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "ESM import alias injection in happy-dom",
  "summary": "happy-dom before 21.0.4 may generate executable JavaScript from malformed ESM import aliases. Attackers who can provide HTML or module content can potentially run code as the Node.js process when JavaScript evaluation is enabled.",
  "mitigation": "Upgrade happy-dom to =>21.0.4 or later.",
  "vendor": "npm",
  "product": "npm:happy-dom",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 17.0.0, <= 21.0.3"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "=>21.0.4"
      ],
      "package_name": "happy-dom",
      "purl": "pkg:npm/happy-dom"
    }
  ],
  "cwes": [
    94
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 9.173769466666666,
  "t0_at": null,
  "signals": {
    "public_poc": {
      "at": "2026-10-20T18:13:05+00:00",
      "days": -0.3721225858217593,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T03:08:56.448885+00:00",
      "url": "https://github.com/capricorn86/happy-dom/security/advisories/GHSA-834v-8h66-3h79"
    },
    "trigger_signal": {
      "at": "2026-10-20T18:13:05+00:00",
      "days": -0.3721225858217593,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T03:08:56.448885+00:00",
      "url": "https://github.com/capricorn86/happy-dom/security/advisories/GHSA-834v-8h66-3h79"
    }
  }
}