CVE-2026-73231: Faker Library RCE Vulnerability

CVE-2026-73231 Overview

CVE-2026-73231 is an arbitrary code execution vulnerability in Faker, a widely used JavaScript library that generates fake data for browser and Node.js environments. The flaw exists in the faker.helpers.fake method within src/modules/helpers/eval.ts. Attacker-controlled fake templates can reach the Function constructor through fakeEval.resolveProperty when a function returns another function. This chain enables arbitrary JavaScript code execution in the context of the calling process. The issue is classified under [CWE-95] (Improper Neutralization of Directives in Dynamically Evaluated Code, or Eval Injection) and is fixed in Faker version 10.5.0.

Critical Impact
Applications that pass untrusted input to faker.helpers.fake can be coerced into executing arbitrary JavaScript, leading to full compromise of the Node.js process or browser context.

Affected Products

Faker (@faker-js/faker) versions prior to 10.5.0
Node.js applications embedding Faker with attacker-influenced templates
Browser applications embedding Faker with attacker-influenced templates

Discovery Timeline

2026-08-11 - CVE-2026-73231 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73231

Vulnerability Analysis

The faker.helpers.fake method interprets template strings that reference properties on the Faker module. Property resolution is delegated to resolveProperty inside fakeEval. When a resolved property is a function, the resolver invokes it and continues walking the returned value. If that function returns another function, the walker eventually traverses to the intrinsic Function constructor. An attacker who controls the template can then invoke Function("...")() to execute arbitrary JavaScript. Because Faker executes with the privileges of the host process, exploitation grants the attacker code execution inside the Node.js runtime or the browser sandbox.

Root Cause

The root cause is unbounded property traversal on the result of a function invocation during template evaluation. The pre-patch code returned entrypoint?.[key as keyof typeof entrypoint] directly, allowing lookups such as constructor on function values. This chain reaches Function, which is a native code compiler exposed on every function object in JavaScript. Combined with lazy template resolution, this behavior satisfies the definition of eval injection under [CWE-95].

Attack Vector

Exploitation requires the application to pass attacker-controlled or attacker-influenced strings into faker.helpers.fake. Typical scenarios include user-supplied template fields in test tooling, seed data generators exposed over HTTP, or mock data services that accept caller-provided formats. The attacker crafts a template that navigates from an exposed helper to constructor and then to Function, producing a payload executed at template-render time.

typescript

// Security patch in src/modules/helpers/eval.ts
// fix(helpers): lazy results in fake (#3852)
         return undefined;
       }
 
-      return entrypoint?.[key as keyof typeof entrypoint];
+      return resolveProperty(entrypoint, key);
     }
 
     case 'object': {
// Source: https://github.com/faker-js/faker/commit/54586208f904012f57c50b46cc1ad32bcbe4bfb7

The patch replaces direct property indexing with a controlled resolveProperty call that constrains what can be reached from a function result, preventing traversal to the Function constructor.

Detection Methods for CVE-2026-73231

Indicators of Compromise

Presence of @faker-js/faker at a version below 10.5.0 in package.json, package-lock.json, or yarn.lock
Template strings passed to faker.helpers.fake that reference constructor, Function, prototype, or __proto__
Unexpected child processes spawned from Node.js services that invoke Faker template rendering
Outbound network connections originating from processes that only render mock data

Detection Strategies

Perform software composition analysis on all Node.js and front-end projects to enumerate Faker versions.
Add static analysis rules that flag calls to faker.helpers.fake receiving non-literal template arguments.
Instrument runtime logging around faker.helpers.fake to capture template inputs during development and staging.
Review web application logs for HTTP parameters containing property-traversal syntax near endpoints known to invoke Faker.

Monitoring Recommendations

Monitor Node.js processes for anomalous child_process.spawn or exec invocations tied to services that only generate test data.
Alert on file system writes and outbound sockets from short-lived data-generation workers.
Track dependency updates through the software bill of materials (SBOM) pipeline and gate deployments on Faker >=10.5.0.

How to Mitigate CVE-2026-73231

Immediate Actions Required

Upgrade @faker-js/faker to version 10.5.0 or later across all applications, build pipelines, and container images.
Audit every call site of faker.helpers.fake and remove any path where template strings originate from untrusted input.
Rebuild and redeploy any browser bundles that ship Faker to clients, invalidating cached assets.
Rotate secrets accessible to any Node.js process that could have executed attacker-controlled templates.

Patch Information

The fix is delivered in Faker 10.5.0. See the GitHub Release v10.5.0, the GitHub Security Advisory GHSA-qxc2-j82w-r537, the GitHub Pull Request Discussion, and the GitHub Commit Update for full details on the corrected property resolver.

Workarounds

Refuse to pass any user-controlled string into faker.helpers.fake until the upgrade is applied.
Restrict faker.helpers.fake to server-side test tooling that never processes external input.
Enforce a Content Security Policy that disallows unsafe-eval in browser contexts to blunt exploitation of Function constructor abuse.

bash

# Upgrade Faker to the patched release
npm install @faker-js/faker@^10.5.0

# Verify the installed version
npm ls @faker-js/faker

# Audit remaining dependencies for advisories
npm audit --production