Description

Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to access the Function constructor through fakeEval.resolveProperty when a function returns another function, enabling arbitrary JavaScript code execution. This issue is fixed in version 10.5.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-11T20:18:48.400Z",
  "pubdate": "2026-08-11T20:18:48.400Z",
  "executiveSummary": "A remote code execution vulnerability exists within the Faker library prior to version 10.5.0, specifically within the faker.helpers.fake method.\nThe vulnerability allows an attacker providing malicious fake templates to achieve arbitrary JavaScript code execution in the context of the running application.\nThis flaw impacts both browser and Node.js environments utilizing affected versions of the Faker product.\nThe root cause lies in improper property resolution via fakeEval.resolveProperty, which grants unauthorized access to the underlying Function constructor when a nested function returns another function.\nAn attacker with the capability to supply or manipulate template strings passed to the vulnerable helper method can successfully trigger this execution flow without requiring complex authentication or specific privilege tiers, provided they can influence the input templates processed by the application.\nThe risk implications are severe, as arbitrary code execution can lead to full system compromise, data exfiltration, or cross-site scripting depending on whether the execution occurs in Node.js or a browser environment.",
  "technicalDetails": "The vulnerability resides in the src/modules/helpers/eval.ts file of the Faker library, specifically affecting versions prior to 10.5.0.\nThe vulnerable component is the faker.helpers.fake method, which processes dynamic template strings to generate pseudo-random data.\nDuring template evaluation, the internal mechanism relies on fakeEval.resolveProperty to resolve properties and execute expressions.\nA flaw in this resolution logic occurs when a function invocation within the template returns another function.\nInstead of restricting access to safe data generation primitives, the property resolution routine inadvertently permits access to the JavaScript Function constructor.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious fake template containing specially structured syntax designed to trigger the unsafe property resolution path. Second, the application passes this untrusted template string to the faker.helpers.fake method. Third, during the evaluation of the template, the helper traverses object properties in a way that bypasses expected sandbox boundaries, eventually reaching the Function constructor via the nested function return behavior. Finally, the attacker leverages the Function constructor to instantiate and execute arbitrary JavaScript payloads within the runtime environment.\nNo authentication or elevated privileges are strictly required to exploit this vulnerability if the application dynamically evaluates user-supplied strings as Faker templates.\nThe network exposure depends entirely on the application architecture; if the vulnerable method parses external or user-submitted input via HTTP requests or client-side interactions, it can be exploited remotely.\nThe post-exploitation impact includes arbitrary command execution, potential compromise of the host server in Node.js deployments, or session hijacking and DOM manipulation in browser environments."
}