https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 18:38:27 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-352019 EUVD-2026-352019 https://cve.radiocsirt.org/vuln/euvd-2026-352019 https://cve.radiocsirt.org/vuln/fkie_cve-2026-73231 <p>Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to access the Function constructor through fakeEval.resolveProperty when a function returns another function, enabling arbitrary JavaScript code execution. This issue is fixed in version 10.5.0.</p> <p>Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to access the Function constructor through fakeEval.resolveProperty when a function returns another function, enabling arbitrary JavaScript code execution. This issue is fixed in version 10.5.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-73231 https://cve.radiocsirt.org/vuln/ghsa-qxc2-j82w-r537 <p><strong>Affected:</strong> npm: @faker-js/faker</p> <p>### Summary</p> <p>`faker.helpers.fake` can be tricked into arbritary code execution.</p> <p>### Details</p> <p>fakeEval.resolveProperty resolves properties on functions itself instead of resolving the nested function first. This can be addressed by recursively calling resolveProperty instead of accessing the property after one iteration.</p> <p>### PoC</p> <p>Go to https://fakerjs.dev/ Open Browser console and run</p> <p>````ts await enableFaker(); // or import faker faker.rawDefinitions.test = (() =&gt; () =&gt; {}); // Any function that returns a function faker.helpers.fake(`{{test.constructor(alert(&#39;PowerLevel: Eval&#39;))}}`); ````</p> <p>### Impact</p> <p>The Fake method claims:</p> <p>&gt; It is also NOT possible to use any non-faker methods or plain javascript in such patterns.</p> <p>Which is objectively false, since any global gets fully accessible in the fake string.</p> <p><strong>Affected:</strong> npm: @faker-js/faker</p> <p>### Summary</p> <p>`faker.helpers.fake` can be tricked into arbritary code execution.</p> <p>### Details</p> <p>fakeEval.resolveProperty resolves properties on functions itself instead of resolving the nested function first. This can be addressed by recursively calling resolveProperty instead of accessing the property after one iteration.</p> <p>### PoC</p> <p>Go to https://fakerjs.dev/ Open Browser console and run</p> <p>````ts await enableFaker(); // or import faker faker.rawDefinitions.test = (() =&gt; () =&gt; {}); // Any function that returns a function faker.helpers.fake(`{{test.constructor(alert(&#39;PowerLevel: Eval&#39;))}}`); ````</p> <p>### Impact</p> <p>The Fake method claims:</p> <p>&gt; It is also NOT possible to use any non-faker methods or plain javascript in such patterns.</p> <p>Which is objectively false, since any global gets fully accessible in the fake string.</p> https://cve.radiocsirt.org/vuln/ghsa-qxc2-j82w-r537