{"id":"CVE-2026-73231","sourceIdentifier":"security-advisories@github.com","published":"2026-08-11T20:18:48.400","lastModified":"2026-10-24T15:10:00.190","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to access the Function constructor through fakeEval.resolveProperty when a function returns another function, enabling arbitrary JavaScript code execution. This issue is fixed in version 10.5.0."},{"lang":"es","value":"Faker genera cantidades masivas de datos falsos en el navegador y Node.js. Antes de la versión 10.5.0, el método faker.helpers.fake en src/modules/helpers/eval.ts permite que plantillas falsas controladas por el atacante accedan al constructor Function a través de fakeEval.resolveProperty cuyo una función devuelve otra función, lo que permite la ejecución arbitraria de código JavaScript. Este problema se corrigió en la versión 10.5.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"faker-js","product":"faker","versions":[{"version":"< 10.5.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-13T14:41:05.021103Z","id":"CVE-2026-73231","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-95"}]}],"references":[{"url":"https://github.com/faker-js/faker/commit/54586208f904012f57c50b46cc1ad32bcbe4bfb7","source":"security-advisories@github.com"},{"url":"https://github.com/faker-js/faker/pull/3852","source":"security-advisories@github.com"},{"url":"https://github.com/faker-js/faker/releases/tag/v10.5.0","source":"security-advisories@github.com"},{"url":"https://github.com/faker-js/faker/security/advisories/GHSA-qxc2-j82w-r537","source":"security-advisories@github.com"},{"url":"https://github.com/faker-js/faker/security/advisories/GHSA-qxc2-j82w-r537","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}