Read the docs
TI-2026-51368 Aliases CVE-2026-73231GHSA-qxc2-j82w-r537

Faker: helpers.fake exploitable into arbritary code execution

Priority HIGH 69CWE-95Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-95.

Summary

Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to access the Function constructor through fakeEval.resolveProperty when a function returns another function, enabling arbitrary JavaScript code execution. This issue is fixed in version 10.5.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0021 11th percentileScored 2026-11-07
Fix Fixed faker (faker-js): 10.5.0@faker-js/faker (npm): 10.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
faker-jsfakerbefore 10.5.010.5.0Patch availableCNA
—@faker-js/faker (npm)before 10.5.010.5.0Patch availableGHSA-qxc2-j82w-r537
  • faker Vendorfaker-js Affected before 10.5.0 Fixed in 10.5.0 Patch available CNA
  • @faker-js/faker (npm) Vendor— Affected before 10.5.0 Fixed in 10.5.0 Patch available GHSA-qxc2-j82w-r537

Remediation

  • Fix · CNA faker (faker-js) Fixed in 10.5.0
  • Fix · GHSA-qxc2-j82w-r537 @faker-js/faker (npm) Fixed in 10.5.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 7 products
  • Cryostat 4
  • Red Hat AMQ Broker 7
  • Red Hat Build of Keycloak
  • Red Hat Enterprise Linux 10
  • Red Hat Hardened Images
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-73231
  2. 2026-10-03 Alias added: GHSA-qxc2-j82w-r537

References

Advisory 1

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences