CVE-2026-73231: Faker: helpers.fake exploitable into arbritary code execution
Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to access the Function constructor through fakeEval.resolveProperty when a function returns another function, enabling arbitrary JavaScript code execution. This issue is fixed in version 10.5.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Faker (helpers.fake / faker.helpers.fake)to a version that resolves this vulnerability.Fixed in 10.5.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73231?
CVE-2026-73231 has a severity rating of high with a score of 7.8.
What vulnerability does CVE-2026-73231 describe?
CVE-2026-73231 describes a vulnerability in the Faker library that allows arbitrary code execution through the helpers.fake method.
How do I fix CVE-2026-73231?
To fix CVE-2026-73231, update Faker to version 10.5.0 or later.
What components are affected by CVE-2026-73231?
CVE-2026-73231 affects the Faker library used in both browser and Node.js environments.
Can CVE-2026-73231 be exploited remotely?
Yes, CVE-2026-73231 can be exploited remotely since it allows attacker-controlled templates to execute arbitrary code.