Skip to content

chore(deps): update dependency @faker-js/faker to v10 [security] - #524

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-faker-js-faker-vulnerability
Open

chore(deps): update dependency @faker-js/faker to v10 [security]#524
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-faker-js-faker-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Sep 3, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@faker-js/faker (source) ^9.9.0 → ^10.0.0 age confidence

Faker: helpers.fake exploitable into arbritary code execution

CVE-2026-73231 / GHSA-qxc2-j82w-r537

More information

Details

Summary

faker.helpers.fake can be tricked into arbritary code execution.

Details

fakeEval.resolveProperty resolves properties on functions itself instead of resolving the nested function first.
This can be addressed by recursively calling resolveProperty instead of accessing the property after one iteration.

PoC

Go to https://fakerjs.dev/
Open Browser console and run

await enableFaker(); // or import faker
faker.rawDefinitions.test = (() => () => {}); // Any function that returns a function
faker.helpers.fake(`{{test.constructor(alert('PowerLevel: Eval'))}}`);
Impact

The Fake method claims:

It is also NOT possible to use any non-faker methods or plain javascript in such patterns.

Which is objectively false, since any global gets fully accessible in the fake string.

Severity

  • CVSS Score: 7.8 / 10 (High)
  • Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

faker-js/faker (@​faker-js/faker)

v10.5.0

Compare Source

New Locales
Features
Bug Fixes

v10.4.0

Compare Source

New Locales
Features
Changed Locales
  • locale: filter and cleanup PersonEntryDefintions data (#​3266) (67defc8)
Bug Fixes
  • locales: correct typos and capitalization in es_MX street names (#​3737) (2b32c28)

v10.3.0

Compare Source

New Locales
Features
Changed Locales
Bug Fixes

v10.2.0

Compare Source

New Locales
Features
Bug Fixes

v10.1.0

Compare Source

New Locales
Bug Fixes

v10.0.0

Compare Source

New Locales
Features
  • locales: add animal vocabulary(bear, bird, cat, rabbit, pet_name) in Korean (#​3535) (0d2143c)
Changed Locales

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies label Sep 3, 2026
@renovate

renovate Bot commented Sep 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml
Scope: all 49 workspace projects
Progress: resolved 1, reused 0, downloaded 0, added 0
.                                        | [WARN] deprecated eslint@9.39.4
Progress: resolved 51, reused 0, downloaded 0, added 0
Progress: resolved 56, reused 0, downloaded 0, added 0
Progress: resolved 57, reused 0, downloaded 0, added 0
Progress: resolved 82, reused 0, downloaded 0, added 0
Progress: resolved 96, reused 0, downloaded 8, added 0
Progress: resolved 97, reused 0, downloaded 9, added 0
Progress: resolved 125, reused 0, downloaded 9, added 0
[ERR_PNPM_TRUST_DOWNGRADE] High-risk trust downgrade for "undici-types@6.21.0" (possible package takeover)

This error happened while installing the dependencies of @types/node@22.19.15

Trust checks are based solely on publish date, not semver. A package cannot be installed if any earlier-published version had stronger trust evidence. Earlier versions had provenance attestation, but this version has no trust evidence. A trust downgrade may indicate a supply chain incident.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants