CVE-2026-73231 HIGH

CVE-2026-73231: Faker: helpers.fake exploitable into arbritary code execution

Vendor Faker-Js

Product faker

Weakness CWE-95 · Eval injection

Published August 11, 2026

Last update August 11, 2026

View on NVD All CVEs

CVSS base score

7.8/10

Attack vector Local

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to access the Function constructor through fakeEval.resolveProperty when a function returns another function, enabling arbitrary JavaScript code execution. This issue is fixed in version 10.5.0.

Key dates

02Disclosure timeline

August 11, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-73231 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/95.html AskarLabs — CWE-95 write-up Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Related vulnerabilities

04Related CVE

CVE-2024-8512 W3SPEEDSTER <= 7.26 - Authenticated (Administrator+) Remote Code Execution CVE-2024-10633 Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated Arbitrary Shortcode Execution via content CVE-2026-4001 Woocommerce Custom Product Addons Pro <= 5.4.1 - Unauthenticated Remote Code Execution via Custom Pricing Formula CVE-2024-3562 Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) PHP Code Injection via Loop Custom Field CVE-2011-10033 WordPress Plugin is-human <= v1.4.2 Eval Injection RCE