Vulnerability in studio project

[ankitdn]

While working on studio project, I scanned the dependency manifest and found that it uses a vulnerable version of happy-dom. The scan revealed a code injection issue in the ECMAScriptModuleCompiler, where unsanitized export names can be injected into executable code, potentially leading to remote code execution when processing attacker-controlled HTML.

CVE Report
CVE Link

[sorenbs]

Hi @ankitdn — thanks for flagging. The bump to a patched happy-dom is in #1477 and set to merge shortly. Worth noting for severity assessment: happy-dom is a devDependency here (used only by the test runner), so the vulnerable code isn't part of the published @prisma/studio-core package or any runtime surface — but keeping the toolchain patched is right regardless.