Executive brief
Faker is a popular JavaScript library used to generate fake data for testing and development. The helpers.fake method, which processes template strings containing fake data patterns, contains a code injection vulnerability that allows attackers to execute arbitrary JavaScript in the context of the application using it. An attacker with access to the application's input can craft malicious template strings to gain code execution and compromise the entire system.
Technical details
The vulnerability is a code injection flaw (CWE-95) in the fakeEval.resolveProperty function within the @faker-js/faker library (versions ≤10.4.0). The function improperly resolves property access on functions instead of recursively resolving the nested function first, allowing attackers to access the constructor property of function objects and instantiate arbitrary code. Exploitation requires passing a malicious template string to faker.helpers.fake(), such as {{test.constructor(alert('PowerLevel: Eval'))}}. The attack requires local or direct access to call the fake method with attacker-controlled input; however, no user interaction or elevated privileges are needed. The fix (version 10.5.0 and later) implements recursive property resolution to prevent access to non-faker properties.
Affected products
- faker-js @faker-js/faker <= 10.4.0
Timeline
- 2026-07-08: disclosed
- 2026: patched: Version 10.5.0 released with fix
- 2026-09-02: advisory