GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GHSA-QXC2-J82W-R537

Vulnerability from github – Published: 2026-09-02 14:20 – Updated: 2026-09-02 14:20
VLAI
Summary
Faker: helpers.fake exploitable into arbritary code execution
Details

Summary

faker.helpers.fake can be tricked into arbritary code execution.

Details

fakeEval.resolveProperty resolves properties on functions itself instead of resolving the nested function first. This can be addressed by recursively calling resolveProperty instead of accessing the property after one iteration.

PoC

Go to https://fakerjs.dev/ Open Browser console and run

await enableFaker(); // or import faker
faker.rawDefinitions.test = (() => () => {}); // Any function that returns a function
faker.helpers.fake(`{{test.constructor(alert('PowerLevel: Eval'))}}`);

Impact

The Fake method claims:

It is also NOT possible to use any non-faker methods or plain javascript in such patterns.

Which is objectively false, since any global gets fully accessible in the fake string.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 10.4.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@faker-js/faker"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73231"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-95"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-02T14:20:14Z",
    "nvd_published_at": "2026-08-11T20:18:48Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\n`faker.helpers.fake` can be tricked into arbritary code execution.\n\n### Details\n\nfakeEval.resolveProperty resolves properties on functions itself instead of resolving the nested function first.\nThis can be addressed by recursively calling resolveProperty instead of accessing the property after one iteration.\n\n### PoC\n\nGo to https://fakerjs.dev/\nOpen Browser console and run\n\n````ts\nawait enableFaker(); // or import faker\nfaker.rawDefinitions.test = (() =\u003e () =\u003e {}); // Any function that returns a function\nfaker.helpers.fake(`{{test.constructor(alert(\u0027PowerLevel: Eval\u0027))}}`);\n````\n\n### Impact\n\nThe Fake method claims:\n\n\u003e It is also NOT possible to use any non-faker methods or plain javascript in such patterns.\n\nWhich is objectively false, since any global gets fully accessible in the fake string.",
  "id": "GHSA-qxc2-j82w-r537",
  "modified": "2026-09-02T14:20:14Z",
  "published": "2026-09-02T14:20:14Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/faker-js/faker/security/advisories/GHSA-qxc2-j82w-r537"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73231"
    },
    {
      "type": "WEB",
      "url": "https://github.com/faker-js/faker/pull/3852"
    },
    {
      "type": "WEB",
      "url": "https://github.com/faker-js/faker/commit/54586208f904012f57c50b46cc1ad32bcbe4bfb7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/faker-js/faker"
    },
    {
      "type": "WEB",
      "url": "https://github.com/faker-js/faker/releases/tag/v10.5.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Faker: helpers.fake exploitable into arbritary code execution"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.