CVE-2026-73231 in faker
Summary
by MITRE • 08/11/2026
Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to access the Function constructor through fakeEval.resolveProperty when a function returns another function, enabling arbitrary JavaScript code execution. This issue is fixed in version 10.5.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability under discussion affects the Faker library, a popular tool for generating realistic fake data in both browser and Node.js environments. This security flaw specifically targets the faker.helpers.fake method implementation in versions prior to 10.5.0, creating a critical path for arbitrary code execution that could be exploited by malicious actors. The issue stems from how the library processes template strings during data generation, particularly when handling nested function calls within these templates.
The technical flaw manifests through the fakeEval.resolveProperty function which inadvertently exposes access to the Function constructor during template evaluation. When an attacker crafts a malicious template string that includes function calls returning other functions, this exposure allows the execution of arbitrary JavaScript code within the context where Faker is running. The vulnerability essentially creates a sandbox escape scenario where the controlled input can bypass normal execution boundaries and gain access to core JavaScript constructors. This represents a classic server-side request forgery or code injection vector that leverages the library's internal evaluation mechanisms.
The operational impact of this vulnerability extends significantly across different deployment scenarios since Faker is commonly used in development environments, testing frameworks, and production applications where user-provided templates might be processed. Attackers could exploit this weakness to execute malicious code on systems running vulnerable versions of Faker, potentially leading to data breaches, privilege escalation, or full system compromise depending on the execution environment. The vulnerability particularly affects web applications that use Faker for generating test data or user interfaces, as well as backend services that process template strings from untrusted sources.
Security mitigations for this vulnerability include upgrading to Faker version 10.5.0 or later where the issue has been properly addressed through enhanced input validation and restriction of direct constructor access during template processing. Organizations should implement comprehensive dependency monitoring to identify all instances of vulnerable Faker versions across their codebases, particularly in development tools and automated testing environments. The fix implemented by the Faker maintainers likely involves sanitizing function return values and preventing direct exposure of the Function constructor during template evaluation cycles.
This vulnerability aligns with CWE-94, which describes improper control of generation of code, specifically addressing the execution of arbitrary code through insecure template processing. From an ATT&CK framework perspective, this maps to technique T1059.007 for JavaScript and JScript execution, representing a code injection attack vector that could be leveraged for privilege escalation or lateral movement within compromised systems. The vulnerability demonstrates how seemingly benign data generation tools can become attack vectors when they fail to properly validate or sanitize user-controlled inputs, particularly in contexts where template strings are evaluated with elevated privileges.