{"schema":"threatline.record/2","record":{"id":"CVE-2026-118660","aliases":["GHSA-c8p4-j97h-3vg8"],"summary":"Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML","details":"Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel=\"stylesheet\" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading default to false. An attacker who controls parsed HTML can therefore cause server-side requests to arbitrary internal or cloud endpoints without an application opt-in and may expose confidential responses or credentials returned by those endpoints. This issue is fixed in version 21.0.0.","categories":["Unclassified"],"product":"happy-dom","vendor":"capricorn86","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-118660","source_modified_at":"2026-10-28T20:23:10.122Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"happy-dom","vendor":"capricorn86","versions":[{"version":"< 21.0.0","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":8.6,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T20:23:10.122Z","modified_at":"2026-10-28T20:23:10.122Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-118660","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-28T20:23:10.122Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/capricorn86/happy-dom/security/advisories/GHSA-c8p4-j97h-3vg8","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/capricorn86/happy-dom/pull/2502","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/capricorn86/happy-dom/commit/0a99c7525a1d0043e3182843ae33466ab7b19e74","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/capricorn86/happy-dom/releases/tag/v21.0.0","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T20:23:10.122Z","content_hash":"04dacdf0292dc711fc296bc2acef06101b607980a70c22989cebe02128616a38"}}