CVE-2026-73231

Published: Aug 11, 2026Modified: Aug 13, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: security-advisories@github.com (Secondary)

Description

Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to access the Function constructor through fakeEval.resolveProperty when a function returns another function, enabling arbitrary JavaScript code execution. This issue is fixed in version 10.5.0.

Related CWEs

CWE-95

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

References (5)

https://github.com/faker-js/faker/commit/54586208f904012f57c50b46cc1ad32bcbe4bfb7

Source: security-advisories@github.com

https://github.com/faker-js/faker/pull/3852

Source: security-advisories@github.com

https://github.com/faker-js/faker/releases/tag/v10.5.0

Source: security-advisories@github.com

https://github.com/faker-js/faker/security/advisories/GHSA-qxc2-j82w-r537

Source: security-advisories@github.com

https://github.com/faker-js/faker/security/advisories/GHSA-qxc2-j82w-r537

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.