CVE-2026-73231
CVE-2026-73231: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityHigh8.8
High [CVE-2026-73231] @faker-js/faker: Faker: Arbitrary Code Execution via attacker-controlled fake templates
CVE-2026-73231Source published Source updated
Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to access the Function constructor through fakeEval.resolveProperty when a function returns another function, enabling arbitrary JavaScript code execution. This issue is fixed in version 10.5.0. A flaw was found in Faker, a library for generating fake data. This could allow an attacker to run malicious code within the application. Red Hat products ship @faker-js/faker as a bundled dependency. Faker is typically used for test data generation rather than in production code paths, which limits the practical attack surface. Upgrade to @faker-js/faker version 10.5.0 or later. Red Hat severity: Important…
- Affected products in this advisory
- No product details extracted. Check the source bulletin.
- Source-reported affected versions
- < 10.5.0
- Source-reported fixed versions
- 10.5.0
- Mitigation guidance
- Do not pass untrusted or user-controlled input to the faker.helpers.fake() method. If Faker is only used for testing, ensure it is not included in production builds. Upgrading to @faker-js/faker version 10.5.0 resolves the underlying code injection vulnerability.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.