High [CVE-2026-73231] @faker-js/faker: Faker: Arbitrary Code Execution via attacker-controlled fake templates
This high-severity Red Hat Linux advisory covers CVE-2026-73231.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to access the Function constructor through fakeEval.resolveProperty when a function returns another function, enabling arbitrary JavaScript code execution.
This issue is fixed in version 10.5.0. A flaw was found in Faker, a library for generating fake data.
This could allow an attacker to run malicious code within the application. Red Hat products ship @faker-js/faker as a bundled dependency.
Faker is typically used for test data generation rather than in production code paths, which limits the practical attack surface. Upgrade to @faker-js/faker version 10.5.0 or later.
Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-94.
Red Hat lists Cryostat 4; Red Hat AMQ Broker 7; Red Hat Build of Keycloak; Red Hat Enterprise Linux 10; Red Hat Hardened Images; Red Hat JBoss Enterprise Application Platform 8; Red Hat JBoss Enterprise Application Platform Expansion Pack as not affected.
- < 10.5.0
Official advisory · high-confidence parse· fetched 28 days ago·verify at source
Mitigation checklist
- Do not pass untrusted or user-controlled input to the faker.helpers.fake() method. If Faker is only used for testing, ensure it is not included in production builds. Upgrading to @faker-js/faker version 10.5.0 resolves the underlying code injection vulnerability.
Official advisory · high-confidence parse· fetched 28 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.