Arbitrary Code Execution in Faker.js helpers.fake

Faker.js versions 10.4.0 and earlier are vulnerable to an arbitrary code execution flaw within the helpers.fake method, tracked as CVE-2026-73231. The vulnerability exists due to improper property resolution logic in fakeEval.resolveProperty. Specifically, the function attempts to resolve properties on functions directly rather than performing a recursive resolution. This logic error allows attackers to traverse and access the constructor of objects, providing a path to execute arbitrary JavaScript code.

The library documentation explicitly claims that it is not possible to use non-faker methods or plain JavaScript within fake template strings; however, this vulnerability proves that global objects remain accessible. An attacker can craft a template string containing a payload such as {{test.constructor(alert('Code Execution'))}} to escape the intended sandbox. This impacts any application that processes user-supplied or untrusted strings through the helpers.fake function.

Impact

The vulnerability allows for remote code execution in any environment where an attacker can influence the template string passed to the helpers.fake method. This affects all applications leveraging Faker.js versions 10.4.0 and below. If an application uses this method to process inputs from end-users or external sources, an attacker could achieve full code execution within the Node.js or browser environment, potentially leading to data exfiltration or unauthorized system access.

Recommendation

• Upgrade the @faker-js/faker package to a version beyond 10.4.0 immediately to resolve CVE-2026-73231.
• Audit all application codebases for instances where user-supplied or external input is passed directly into the faker.helpers.fake method.
• If upgrading is not immediately feasible, sanitize all input strings passed to helpers.fake to block characters and patterns that could facilitate access to the constructor property or other global objects.