Skip to content

chore(deps): update dependency @faker-js/faker to v10 [security] - #3988

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate-npm-faker-js-faker-vulnerability
Open

chore(deps): update dependency @faker-js/faker to v10 [security]#3988
renovate[bot] wants to merge 1 commit into
mainfrom
renovate-npm-faker-js-faker-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Oct 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@faker-js/faker (source) ^8.4.1 → ^10.0.0 age confidence

Faker: helpers.fake exploitable into arbritary code execution

CVE-2026-73231 / GHSA-qxc2-j82w-r537

More information

Details

Summary

faker.helpers.fake can be tricked into arbritary code execution.

Details

fakeEval.resolveProperty resolves properties on functions itself instead of resolving the nested function first.
This can be addressed by recursively calling resolveProperty instead of accessing the property after one iteration.

PoC

Go to https://fakerjs.dev/
Open Browser console and run

await enableFaker(); // or import faker
faker.rawDefinitions.test = (() => () => {}); // Any function that returns a function
faker.helpers.fake(`{{test.constructor(alert('PowerLevel: Eval'))}}`);
Impact

The Fake method claims:

It is also NOT possible to use any non-faker methods or plain javascript in such patterns.

Which is objectively false, since any global gets fully accessible in the fake string.

Severity

  • CVSS Score: 7.8 / 10 (High)
  • Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

faker-js/faker (@​faker-js/faker)

v10.5.0

Compare Source

New Locales
Features
Bug Fixes

v10.4.0

Compare Source

New Locales
Features
Changed Locales
  • locale: filter and cleanup PersonEntryDefintions data (#​3266) (67defc8)
Bug Fixes
  • locales: correct typos and capitalization in es_MX street names (#​3737) (2b32c28)

v10.3.0

Compare Source

New Locales
Features
Changed Locales
Bug Fixes

v10.2.0

Compare Source

New Locales
Features
Bug Fixes

v10.1.0

Compare Source

New Locales
Bug Fixes

v10.0.0

Compare Source

New Locales
Features
  • locales: add animal vocabulary(bear, bird, cat, rabbit, pet_name) in Korean (#​3535) (0d2143c)
Changed Locales

v9.9.0

Compare Source

New Locales
Features

v9.8.0

Compare Source

New Locales
Changed Locales
Bug Fixes

v9.7.0

Compare Source

New Locales
Bug Fixes

v9.6.0

Compare Source

Features

v9.5.1

Compare Source

Bug Fixes

v9.5.0

Compare Source

Features

v9.4.0

Compare Source

Features
Changed Locales
Bug Fixes

v9.3.0

Compare Source

Features
Changed Locales
Bug Fixes
  • internet: ensure domainWord always returns a valid value in all locales (#​3253) (525fedc)
  • locale: add Isadora to female names in pt_BR for consistency (#​3282) (b390432)
  • locale: fix incorrect accents in it first_name (#​3281) (e0fb23e)

v9.2.0

Compare Source

Features
Changed Locales

v9.1.0

Compare Source

New Locales
Features
Changed Locales
Bug Fixes

v9.0.3

Compare Source

Changed Locales
Bug Fixes

v9.0.2

Compare Source

Bug Fixes

v9.0.1

Compare Source

Bug Fixes

v9.0.0

Compare Source

No noteworthy changes to 9.0.0-rc.1

For those upgrading from earlier versions, please refer to our Migration Guide for detailed instructions.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency label Oct 3, 2026
@netlify

netlify Bot commented Oct 3, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for brilliant-pasca-3e80ec canceled.

Name Link
🔨 Latest commit a4bf87e
🔍 Latest deploy log https://app.netlify.com/projects/brilliant-pasca-3e80ec/deploys/6ae322322599ae550b7cc8e6

@github-actions github-actions Bot added pkg: backend Changes in the backend package. pkg: auth Changes in the GNAP auth package. labels Oct 3, 2026
@github-actions

github-actions Bot commented Oct 3, 2026 •
edited
Loading

Copy link
Copy Markdown

🚀 Performance Test Results

Test Configuration:

  • VUs: 4
  • Duration: 1m0s

Test Metrics:

  • Requests/s: 85.07
  • Iterations/s: 28.35
  • Failed Requests: 0.00% (0 of 5110)
📜 Logs 

> performance@1.0.0 run-tests:testenv /home/runner/work/rafiki/rafiki/test/performance
> ./scripts/run-tests.sh -e test -k -q --vus 4 --duration 1m

Cloud Nine GraphQL API is up: http://localhost:3101/graphql
Cloud Nine Wallet Address is up: http://localhost:3100/
Happy Life Bank Address is up: http://localhost:4100/
cloud-nine-wallet-test-backend already set
cloud-nine-wallet-test-auth already set
happy-life-bank-test-backend already set
happy-life-bank-test-auth already set
     data_received..................: 1.8 MB 31 kB/s
     data_sent......................: 3.9 MB 65 kB/s
     http_req_blocked...............: avg=5.91µs   min=1.06µs  med=4.29µs  max=807.5µs  p(90)=6.08µs   p(95)=6.89µs  
     http_req_connecting............: avg=111ns    min=0s      med=0s      max=295.55µs p(90)=0s       p(95)=0s      
     http_req_duration..............: avg=46.54ms  min=4.78ms  med=35.34ms max=489.67ms p(90)=82.05ms  p(95)=89.93ms 
       { expected_response:true }...: avg=46.54ms  min=4.78ms  med=35.34ms max=489.67ms p(90)=82.05ms  p(95)=89.93ms 
     http_req_failed................: 0.00%  ✓ 0         ✗ 5110
     http_req_receiving.............: avg=76.23µs  min=16.74µs med=64.71µs max=2.75ms   p(90)=101.17µs p(95)=127.48µs
     http_req_sending...............: avg=29.81µs  min=5.13µs  med=21.55µs max=2.26ms   p(90)=32.09µs  p(95)=48.31µs 
     http_req_tls_handshaking.......: avg=0s       min=0s      med=0s      max=0s       p(90)=0s       p(95)=0s      
     http_req_waiting...............: avg=46.43ms  min=4.69ms  med=35.23ms max=489.57ms p(90)=81.84ms  p(95)=89.84ms 
     http_reqs......................: 5110   85.072513/s
     iteration_duration.............: avg=140.98ms min=94.44ms med=135.2ms max=556.12ms p(90)=172.23ms p(95)=189.11ms
     iterations.....................: 1703   28.351955/s
     vus............................: 4      min=4       max=4 
     vus_max........................: 4      min=4       max=4

@renovate
renovate Bot force-pushed the renovate-npm-faker-js-faker-vulnerability branch from 998cb7e to c756413 Compare October 25, 2026 02:40
@renovate
renovate Bot force-pushed the renovate-npm-faker-js-faker-vulnerability branch from c756413 to a4bf87e Compare October 29, 2026 10:38

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency pkg: auth Changes in the GNAP auth package. pkg: backend Changes in the backend package.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants