CVE-2026-73231

Received Received - Intake

Arbitrary Code Execution in Faker.js Library

Publication date: 2026-08-11

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to access the Function constructor through fakeEval.resolveProperty when a function returns another function, enabling arbitrary JavaScript code execution. This issue is fixed in version 10.5.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-13

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-73231

EUVD

EUVD-2026-56923

Affected Vendors & Products

Vendor	Product	Version / Range
faker-js	faker	10.5.0
faker-js	faker	to 10.5.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-95	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Attack-Flow Graph

Executive Summary

CVE-2026-73231 is a high-severity vulnerability in the @faker-js/faker npm package affecting versions 10.4.0 and below. It allows arbitrary JavaScript code execution through the faker.helpers.fake function due to improper property resolution in fakeEval.resolveProperty. Attackers can inject malicious code via crafted template strings, such as {{test.constructor(alert('PowerLevel: Eval'))}}, leading to complete system compromise.

Detection Guidance

To detect this vulnerability, check the installed version of @faker-js/faker in your project using npm list @faker-js/faker or npm ls @faker-js/faker. If the version is <= 10.4.0, the system is vulnerable. Review code using faker.helpers.fake for suspicious template strings like {{test.constructor(alert('PowerLevel: Eval'))}}.

Impact Analysis

If you use a vulnerable version of @faker-js/faker (<=10.4.0) in your application, an attacker could execute arbitrary JavaScript code in your environment. This could lead to data theft, unauthorized actions, or full system takeover. The attack requires no privileges or user interaction and has low complexity, making it highly dangerous.

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized data access or modification. GDPR requires protecting personal data integrity and confidentiality, while HIPAA mandates safeguarding protected health information. A successful exploit could result in data breaches, leading to regulatory penalties and legal consequences.

Mitigation Strategies

Immediately upgrade @faker-js/faker to version 10.5.0 or later using npm update @faker-js/faker or npm install @faker-js/faker@latest. Audit and remove any untrusted template strings in faker.helpers.fake usage to prevent code injection.

Hi! I’m here to help you understand CVE-2026-73231. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70