HIGHCVSS 7.8EPSS 0.2%

CVE-2026-73231

CVE-2026-73231 updated by NVD

Published: 2026-09-02
Modified: 2026-09-11
EPSS percentile: 5%
Sources: github-advisory, nvd

Summary

Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to access the Function constructor through fakeEval.resolveProperty when a function returns another function, enabling arbitrary JavaScript code execution. This issue is fixed in version 10.5.0.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
npm	@faker-js/faker	—	10.5.0

Remediation: Upgrade to 10.5.0 or later.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-73231

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.