Vulnerability Description
Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to access the Function constructor through fakeEval.resolveProperty when a function returns another function, enabling arbitrary JavaScript code execution. This issue is fixed in version 10.5.0.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/faker-js/faker/commit/54586208f904012f57c50b46cc1ad32bcbe4bfb
- https://github.com/faker-js/faker/pull/3852
- https://github.com/faker-js/faker/releases/tag/v10.5.0
- https://github.com/faker-js/faker/security/advisories/GHSA-qxc2-j82w-r537
- https://github.com/faker-js/faker/security/advisories/GHSA-qxc2-j82w-r537
FAQ
What is CVE-2026-73231?
CVE-2026-73231 is a vulnerability with a CVSS score of 7.8 (HIGH). Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to acce...
How severe is CVE-2026-73231?
CVE-2026-73231 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-73231?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.