CVE-2026-73231
Faker: helpers.fake exploitable into arbritary code execution
CVSS Score
7.8
EPSS Score
0.0%
EPSS Percentile
0th
Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to access the Function constructor through fakeEval.resolveProperty when a function returns another function, enabling arbitrary JavaScript code execution. This issue is fixed in version 10.5.0.
| CWE | CWE-95 |
| Vendor | faker-js |
| Product | faker |
| Published | Aug 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for faker-js faker
Be the first to know when new high vulnerabilities affecting faker-js faker are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
faker-js / faker
< 10.5.0
References
github.com: https://github.com/faker-js/faker/security/advisories/GHSA-qxc2-j82w-r537 github.com: https://github.com/faker-js/faker/pull/3852 github.com: https://github.com/faker-js/faker/commit/54586208f904012f57c50b46cc1ad32bcbe4bfb7 github.com: https://github.com/faker-js/faker/releases/tag/v10.5.0