GeezerVison

Details

Summary

faker.helpers.fake can be tricked into arbritary code execution.

Details

fakeEval.resolveProperty resolves properties on functions itself instead of resolving the nested function first.
This can be addressed by recursively calling resolveProperty instead of accessing the property after one iteration.

PoC

Go to https://fakerjs.dev/
Open Browser console and run

await enableFaker(); // or import faker
faker.rawDefinitions.test = (() => () => {}); // Any function that returns a function
faker.helpers.fake(`{{test.constructor(alert('PowerLevel: Eval'))}}`);

Impact

The Fake method claims:

It is also NOT possible to use any non-faker methods or plain javascript in such patterns.

Which is objectively false, since any global gets fully accessible in the fake string.

Severity

• CVSS Score: 7.8 / 10 (High)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

• https://github.com/faker-js/faker/security/advisories/GHSA-qxc2-j82w-r537
• https://nvd.nist.gov/vuln/detail/CVE-2026-73231
• https://github.com/faker-js/faker/pull/3852
• https://github.com/faker-js/faker/commit/54586208f904012f57c50b46cc1ad32bcbe4bfb7
• https://github.com/faker-js/faker/releases/tag/v10.5.0
• https://github.com/advisories/GHSA-qxc2-j82w-r537

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

v10.5.0

Compare Source

New Locales

• locale: add color to cy (#​3816) (5a6379f)
• locale: add Farsi airline module locale (#​3789) (f4a1c3e)
• locale: add mn_MN_cyrl (Mongolian) locale (#​3796) (d17c0f1)
• locale: Add more realistic Greek address data (#​3792) (6153eb7)
• locale: Add postal_address and improved secondary_address for es (#​3798) (6c2a0ab)
• locale: add sl_SI locale, location module (#​3652) (28d4f7c)
• locale: add Welsh (cy) animal type definitions (#​3842) (50a5ec9)
• locale: add Welsh (cy) book format definitions (#​3846) (#​3846) (2b32d6e)
• locale: add Welsh (cy) building numbers definition (#​3892) (4996a2b)
• locale: add Welsh (cy) city name definitions (#​3884) (ac36c22)
• locale: add Welsh (cy) continents definitions (#​3880) (03a1682)
• locale: add Welsh (cy) county definitions (#​3849) (f51d28a)
• locale: add Welsh (cy) direction definitions (#​3840) (d862071)
• locale: add Welsh (cy) internet domain suffix definitions (#​3865) (#​3865) (fb2e2cb)
• locale: add Welsh (cy) phone number definitions (#​3878) (70994db)
• locale: add Welsh (cy) postal address definitions (#​3850) (e72fd7c)
• locale: add Welsh (cy) postcode definitions (#​3851) (1afbd59)
• locale: add Welsh (cy) sex definitions (#​3824) (6f29eb7)
• locale: add Welsh (cy) state definitions (#​3891) (#​3891) (606d47c)
• locale: add Welsh (cy) street name definitions (#​3889) (143789e)
• locale: add Welsh (cy) vehicle fuel definitions (#​3845) (29c918a)
• locale: extend tr person last names (#​3839) (f433771)
• locale: improved en_GB postcodes (#​3864) (a4e5039)
• locale: improved en_IE postal_address (#​3797) (fb3ffd3)

Features

• add first standalone module functions (#​3818) (5d4f5de)
• date: add ability to provide date range for recent and soon (#​3844) (0bc038d)
• date: add ability to provide year range for past and future (#​3783) (237e7dc)
• food: expand plant-based dish and pattern variety (#​3887) (5eaf729)
• introduce FakerCore (#​2838) (68e15d7)
• location: add postal address generation (#​3760) (753bec6)
• number: add distributor functions (#​3375) (325e402)
• phone: mobile style for phone.number (#​3583) (cd5953b)

Bug Fixes

• date: incorrect date boundary in past and future (#​3827) (0446411)
• finance: routingNumber now uses real FederalReserveRoutingSymbol from lookup table. (#​3429) (c53c1fe)
• food: correct fruit and vegetable locale data (#​3800) (30a812a)
• handle single-character fromRegExp patterns (#​3877) (ec6cc3b)
• helpers: ignore wrapper characters in fromRegExp (#​3795) (9e2c0e3)
• helpers: lazy results in fake (#​3852) (5458620)
• hide warnings for permanently disabled test stubs (#​3860) (03252b9)
• link release checklist in release PR workflow (#​3802) (8436c4f)
• locale: changed farsi phone locales to correct ones (#​3775) (5e1ce98)
• locale: phone numbers for en_AU (#​3788) (eba7d99)
• locale: remove citation brackets from snake names (#​3822) (bda44d0)
• locale: typo in de_CH last name (#​3799) (17138d8)
• validate unsupported fileExt mime types (#​3879) (d11b5d3)

v10.4.0

Compare Source

New Locales

• locale: add Japanese bear definitions (#​3720) (2a4b15c)
• locale: add Japanese bird definitions (#​3719) (dc31ff8)
• locale: add Japanese cat breed definitions (#​3716) (54af8a8)
• locale: add Japanese cattle breed definitions (#​3717) (c2c7342)
• locale: add Japanese fish definitions (#​3721) (15fc361)
• locale: add Japanese horse breed definitions (#​3718) (e02536e)
• locale: add Norwegian (nb_NO) country definition (#​3714) (614b4e9)

Features

• fi locale phone numbers (#​3747) (7afa8b5)
• food: add plant-based dish variety (#​3745) (41edf49)

Changed Locales

• locale: filter and cleanup PersonEntryDefintions data (#​3266) (67defc8)

Bug Fixes

• locales: correct typos and capitalization in es_MX street names (#​3737) (2b32c28)

v10.3.0

Compare Source

New Locales

• locale: add Japanese dog definition (#​3715) (76c9df1)
• locale: add Japanese color definitions (#​3707) (bbbb215)
• locale: add Japanese food module (#​3706) (71d55c0)
• locale: add Japanese internet definitions (#​3708) (184a709)
• locale: add Japanese job definitions for person module (#​3705) (e7f3ccd)
• locale: add Japanese suffix definitions for person module (#​3704) (45ad7d8)
• locale: add Norwegian (nb_NO) continent definitions (#​3712) (c0f0f23)
• locale: add Norwegian (nb_NO) direction definition (#​3713) (43b18fa)
• locale: add Norwegian (nb_NO) sex definitions (#​3710) (76063f2)
• locale: add Norwegian (nb_NO) vehicle definition (#​3732) (d1c32b0)

Features

• locales: add Norwegian (nb_NO) zodiac sign definitions (#​3711) (e306542)
• person: sexType can return 'generic' (#​3259) (0e099a1)
• string: support uuid v7 (#​3701) (87c2753)

Changed Locales

• locale: normalize system locale data (#​3702) (ba91653)

Bug Fixes

• locale: remove empty string from Hebrew lorem words (#​3698) (81a896c)
• location: state name to 'Trøndelag' for nb_NO (#​3691) (eaef389)

v10.2.0

Compare Source

New Locales

• locale: add bn_BD location module (#​3614) (99a448c)
• locale: add counties & states to nb_NO location (#​3617) (3dbcbe1)
• locale: add da states (regions) (#​3656) (78c892b)
• locale: add id_ID translation for animal, color, commerce, and word also add country to location id_ID translation. (#​3608) (02c2c3e)
• locale: add ku_kmr_latin locale (#​3629) (247f42d)
• locale: add person module data to ku_ckb (#​3630) (6be2c20)

Features

• Add support for UPC (#​3648) (57b2d78)
• commerce: allow for locale-specific product name patterns (#​3657) (1cf3991)
• finance: add IR iban (#​3678) (101a74a)
• locales: add sl_SI locale, person module (#​3564) (e7c9945)
• location: Hungarian support for city name, full street address, continents, countries and directions (hu) (#​3618) (2c9aefd)

Bug Fixes

• food: move raspberry from vegetable to fruit (#​3650) (6a4f01f)
• locale: endonym should be in Latin script (#​3660) (4cda07f)
• locale: remove additional inappropriate words from ja locale (#​3665) (18a1554)
• locale: remove offensive and inappropriate words from ja locale (#​3661) (8310c8c)
• locale: remove some negative hu words (#​3664) (bd36bae)
• location: Use accents in en country names (#​3637) (24aa11f)
• vehicle: Updated spelling Mercielago to Murcielago (#​3636) (bfb1bdb)

v10.1.0

Compare Source

New Locales

• locale: Add ku_ckb locale (#​3441) (9de894a)
• locale: add Russian localization for book module (#​3628) (428ff33)

Bug Fixes

• locale: fix the Spring Airlines IATA Code (#​3612) (b547045)

v10.0.0

Compare Source

New Locales

• locale: extended list of colors in Polish (#​3586) (9940d54)

Features

• locales: add animal vocabulary(bear, bird, cat, rabbit, pet_name) in Korean (#​3535) (0d2143c)

Changed Locales

• locale: remove invalid credit card issuer patterns (#​3568) (9783d95)