Tharvid

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. When parsing untrusted HTML on the server, the software loads `iframe` `src` URLs and `link rel="stylesheet"` `href` URLs by default. This occurs because the variables `disableIframePageLoading` and `disableCSSFileLoading` default to `false`. An attacker who controls the parsed HTML can trigger Server-Side Request Forgery (SSRF), causing the server to make requests to arbitrary internal or cloud endpoints. This may lead to the exposure of confidential responses, internal network scanning, or the theft of cloud credentials from metadata endpoints.

XMLBuilder fails to escape the "-->" sequence in comment content and the ">>" sequence in CDATA sections when generating XML from JavaScript objects. This flaw enables XML injection if user-controlled data is included in comments or CDATA elements, which can result in cross-site scripting (XSS), SOAP injection, or data manipulation.

The software allows attacker-controlled comment content to be serialized into XML without validating or neutralizing comment-breaking sequences. This occurs during the DOM construction and serialization flow for comment nodes when the `createComment()` function is called; the supplied string is stored as-is and later concatenated with XML comment delimiters during serialization. Because XML comments are syntax-sensitive, an attacker can provide input containing a sequence that closes the comment, allowing them to terminate the comment early and inject arbitrary XML nodes into the serialized output. This can enable an attacker to alter the meaning and structure of generated XML documents, affecting workflows that store, forward, sign, or parse the resulting XML, such as configuration or policy documents.

The package serializes `DocumentType` node fields (`internalSubset`, `publicId`, and `systemId`) verbatim without escaping or validation. When these fields are set programmatically via the `createDocumentType()` function or direct property writes using attacker-controlled strings, the `XMLSerializer.serializeToString` method can produce output where the DOCTYPE declaration is terminated prematurely, allowing arbitrary markup to appear outside of it. Specifically, injecting `]>` into `internalSubset` or `>` into `systemId` can close the DOCTYPE early, while manipulating `publicId` can break the quoting context to inject fake SYSTEM entries. This can lead to XXE-class attacks if downstream XML parsers re-parse the output with entity expansion enabled.

The software allows attacker-controlled processing instruction (PI) data to be serialized into XML without validating or neutralizing the PI-closing sequence `?>`. This occurs because the `createProcessingInstruction()` function stores the `data` variable directly without validation, and the serializer subsequently concatenates this data verbatim. An attacker can use the `?>` sequence to terminate the processing instruction prematurely and inject arbitrary XML nodes into the serialized output, potentially altering the structure and meaning of the generated XML documents.