GHSA-qxc2-j82w-r537

Source

https://github.com/advisories/GHSA-qxc2-j82w-r537

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-qxc2-j82w-r537/GHSA-qxc2-j82w-r537.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-qxc2-j82w-r537

Aliases

CVE-2026-73231

Downstream

CGA (2)

Published

2026-09-02T14:20:14Z

Modified

2026-09-02T14:30:05Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Faker: helpers.fake exploitable into arbritary code execution

Details

Summary

faker.helpers.fake can be tricked into arbritary code execution.

Details

fakeEval.resolveProperty resolves properties on functions itself instead of resolving the nested function first. This can be addressed by recursively calling resolveProperty instead of accessing the property after one iteration.

PoC

Go to https://fakerjs.dev/ Open Browser console and run

await enableFaker(); // or import faker
faker.rawDefinitions.test = (() => () => {}); // Any function that returns a function
faker.helpers.fake(`{{test.constructor(alert('PowerLevel: Eval'))}}`);

Impact

The Fake method claims:

It is also NOT possible to use any non-faker methods or plain javascript in such patterns.

Which is objectively false, since any global gets fully accessible in the fake string.

Database specific

{
    "cwe_ids":  [
        "CWE-95"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-02T14:20:14Z",
    "nvd_published_at":  "2026-08-11T20:18:48Z",
    "severity":  "HIGH"
}

References

Affected packages

npm / @faker-js/faker

Package

Name: @faker-js/faker; View open source insights on deps.dev
Purl: pkg:npm/%40faker-js/faker

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

10.5.0

Database specific

last_known_affected_version_range

"<= 10.4.0"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-qxc2-j82w-r537/GHSA-qxc2-j82w-r537.json"