Most recent entries from all

EUVD-2026-352019

2026-10-05T20:08:59.399569+00:00

EUVD-2026-352019

fkie_cve-2026-73231

2026-10-05T20:08:59.399628+00:00

Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to access the Function constructor through fakeEval.resolveProperty when a function returns another function, enabling arbitrary JavaScript code execution. This issue is fixed in version 10.5.0.

GHSA-qxc2-j82w-r537 — Faker: helpers.fake exploitable into arbritary code execution

2026-10-05T20:08:59.399689+00:00

Affected: npm: @faker-js/faker

### Summary

`faker.helpers.fake` can be tricked into arbritary code execution.

### Details

fakeEval.resolveProperty resolves properties on functions itself instead of resolving the nested function first. This can be addressed by recursively calling resolveProperty instead of accessing the property after one iteration.

### PoC

Go to https://fakerjs.dev/ Open Browser console and run

````ts await enableFaker(); // or import faker faker.rawDefinitions.test = (() => () => {}); // Any function that returns a function faker.helpers.fake(`{{test.constructor(alert('PowerLevel: Eval'))}}`); ````

### Impact

The Fake method claims:

> It is also NOT possible to use any non-faker methods or plain javascript in such patterns.

Which is objectively false, since any global gets fully accessible in the fake string.