Update dependency @faker-js/faker to v10 [SECURITY] by renovate[bot] · Pull Request #1392 · Stooa/Stooa

renovate · 2026-09-02T22:47:28Z

This PR contains the following updates:

Package	Change	Age	Confidence
@faker-js/faker (source)	`8.4.1` → `10.5.0`

Faker: helpers.fake exploitable into arbritary code execution

CVE-2026-73231 / GHSA-qxc2-j82w-r537

More information

Details

Summary

faker.helpers.fake can be tricked into arbritary code execution.

Details

fakeEval.resolveProperty resolves properties on functions itself instead of resolving the nested function first.
This can be addressed by recursively calling resolveProperty instead of accessing the property after one iteration.

PoC

Go to https://fakerjs.dev/
Open Browser console and run

await enableFaker(); // or import faker
faker.rawDefinitions.test = (() => () => {}); // Any function that returns a function
faker.helpers.fake(`{{test.constructor(alert('PowerLevel: Eval'))}}`);

Impact

The Fake method claims:

It is also NOT possible to use any non-faker methods or plain javascript in such patterns.

Which is objectively false, since any global gets fully accessible in the fake string.

Severity

CVSS Score: 7.8 / 10 (High)
Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

faker-js/faker (@faker-js/faker)

`v10.5.0`

Compare Source

New Locales

locale: add color to cy (#3816) (5a6379f)
locale: add Farsi airline module locale (#3789) (f4a1c3e)
locale: add mn_MN_cyrl (Mongolian) locale (#3796) (d17c0f1)
locale: Add more realistic Greek address data (#3792) (6153eb7)
locale: Add postal_address and improved secondary_address for es (#3798) (6c2a0ab)
locale: add sl_SI locale, location module (#3652) (28d4f7c)
locale: add Welsh (cy) animal type definitions (#3842) (50a5ec9)
locale: add Welsh (cy) book format definitions (#3846) (#3846) (2b32d6e)
locale: add Welsh (cy) building numbers definition (#3892) (4996a2b)
locale: add Welsh (cy) city name definitions (#3884) (ac36c22)
locale: add Welsh (cy) continents definitions (#3880) (03a1682)
locale: add Welsh (cy) county definitions (#3849) (f51d28a)
locale: add Welsh (cy) direction definitions (#3840) (d862071)
locale: add Welsh (cy) internet domain suffix definitions (#3865) (#3865) (fb2e2cb)
locale: add Welsh (cy) phone number definitions (#3878) (70994db)
locale: add Welsh (cy) postal address definitions (#3850) (e72fd7c)
locale: add Welsh (cy) postcode definitions (#3851) (1afbd59)
locale: add Welsh (cy) sex definitions (#3824) (6f29eb7)
locale: add Welsh (cy) state definitions (#3891) (#3891) (606d47c)
locale: add Welsh (cy) street name definitions (#3889) (143789e)
locale: add Welsh (cy) vehicle fuel definitions (#3845) (29c918a)
locale: extend tr person last names (#3839) (f433771)
locale: improved en_GB postcodes (#3864) (a4e5039)
locale: improved en_IE postal_address (#3797) (fb3ffd3)

Features

add first standalone module functions (#3818) (5d4f5de)
date: add ability to provide date range for recent and soon (#3844) (0bc038d)
date: add ability to provide year range for past and future (#3783) (237e7dc)
food: expand plant-based dish and pattern variety (#3887) (5eaf729)
introduce FakerCore (#2838) (68e15d7)
location: add postal address generation (#3760) (753bec6)
number: add distributor functions (#3375) (325e402)
phone: mobile style for phone.number (#3583) (cd5953b)

Bug Fixes

date: incorrect date boundary in past and future (#3827) (0446411)
finance: routingNumber now uses real FederalReserveRoutingSymbol from lookup table. (#3429) (c53c1fe)
food: correct fruit and vegetable locale data (#3800) (30a812a)
handle single-character fromRegExp patterns (#3877) (ec6cc3b)
helpers: ignore wrapper characters in fromRegExp (#3795) (9e2c0e3)
helpers: lazy results in fake (#3852) (5458620)
hide warnings for permanently disabled test stubs (#3860) (03252b9)
link release checklist in release PR workflow (#3802) (8436c4f)
locale: changed farsi phone locales to correct ones (#3775) (5e1ce98)
locale: phone numbers for en_AU (#3788) (eba7d99)
locale: remove citation brackets from snake names (#3822) (bda44d0)
locale: typo in de_CH last name (#3799) (17138d8)
validate unsupported fileExt mime types (#3879) (d11b5d3)

`v10.4.0`

Compare Source

New Locales

locale: add Japanese bear definitions (#3720) (2a4b15c)
locale: add Japanese bird definitions (#3719) (dc31ff8)
locale: add Japanese cat breed definitions (#3716) (54af8a8)
locale: add Japanese cattle breed definitions (#3717) (c2c7342)
locale: add Japanese fish definitions (#3721) (15fc361)
locale: add Japanese horse breed definitions (#3718) (e02536e)
locale: add Norwegian (nb_NO) country definition (#3714) (614b4e9)

Features

fi locale phone numbers (#3747) (7afa8b5)
food: add plant-based dish variety (#3745) (41edf49)

Changed Locales

locale: filter and cleanup PersonEntryDefintions data (#3266) (67defc8)

Bug Fixes

locales: correct typos and capitalization in es_MX street names (#3737) (2b32c28)

`v10.3.0`

Compare Source

New Locales

locale: add Japanese dog definition (#3715) (76c9df1)
locale: add Japanese color definitions (#3707) (bbbb215)
locale: add Japanese food module (#3706) (71d55c0)
locale: add Japanese internet definitions (#3708) (184a709)
locale: add Japanese job definitions for person module (#3705) (e7f3ccd)
locale: add Japanese suffix definitions for person module (#3704) (45ad7d8)
locale: add Norwegian (nb_NO) continent definitions (#3712) (c0f0f23)
locale: add Norwegian (nb_NO) direction definition (#3713) (43b18fa)
locale: add Norwegian (nb_NO) sex definitions (#3710) (76063f2)
locale: add Norwegian (nb_NO) vehicle definition (#3732) (d1c32b0)

Features

locales: add Norwegian (nb_NO) zodiac sign definitions (#3711) (e306542)
person: sexType can return 'generic' (#3259) (0e099a1)
string: support uuid v7 (#3701) (87c2753)

Changed Locales

locale: normalize system locale data (#3702) (ba91653)

Bug Fixes

locale: remove empty string from Hebrew lorem words (#3698) (81a896c)
location: state name to 'Trøndelag' for nb_NO (#3691) (eaef389)

`v10.2.0`

Compare Source

New Locales

locale: add bn_BD location module (#3614) (99a448c)
locale: add counties & states to nb_NO location (#3617) (3dbcbe1)
locale: add da states (regions) (#3656) (78c892b)
locale: add id_ID translation for animal, color, commerce, and word also add country to location id_ID translation. (#3608) (02c2c3e)
locale: add ku_kmr_latin locale (#3629) (247f42d)
locale: add person module data to ku_ckb (#3630) (6be2c20)

Features

Add support for UPC (#3648) (57b2d78)
commerce: allow for locale-specific product name patterns (#3657) (1cf3991)
finance: add IR iban (#3678) (101a74a)
locales: add sl_SI locale, person module (#3564) (e7c9945)
location: Hungarian support for city name, full street address, continents, countries and directions (hu) (#3618) (2c9aefd)

Bug Fixes

food: move raspberry from vegetable to fruit (#3650) (6a4f01f)
locale: endonym should be in Latin script (#3660) (4cda07f)
locale: remove additional inappropriate words from ja locale (#3665) (18a1554)
locale: remove offensive and inappropriate words from ja locale (#3661) (8310c8c)
locale: remove some negative hu words (#3664) (bd36bae)
location: Use accents in en country names (#3637) (24aa11f)
vehicle: Updated spelling Mercielago to Murcielago (#3636) (bfb1bdb)

`v10.1.0`

Compare Source

New Locales

locale: Add ku_ckb locale (#3441) (9de894a)
locale: add Russian localization for book module (#3628) (428ff33)

Bug Fixes

locale: fix the Spring Airlines IATA Code (#3612) (b547045)

`v10.0.0`

Compare Source

New Locales

locale: extended list of colors in Polish (#3586) (9940d54)

Features

locales: add animal vocabulary(bear, bird, cat, rabbit, pet_name) in Korean (#3535) (0d2143c)

Changed Locales

locale: remove invalid credit card issuer patterns (#3568) (9783d95)

`v9.9.0`

Compare Source

New Locales

locale: add word data to pt_br and pt_pt locales (#3531) (a405ac8)

Features

location: simple coordinate methods (#3528) (d07d96d)

`v9.8.0`

Compare Source

New Locales

locale: Add additional Japanese last names to the locale data (#3484) (72e66c3)
locale: add Japanese date and month definitions (#3492) (b70e793)
locale: add Japanese science locale data including elements and units (#3491) (54fd551)
locale: add Japanese sex definitions for person locale (#3495) (1dbd8fa)
locale: add vehicle locale data for Japanese (#3490) (dfadb1d)
locale: add zh_CN book (#3477) (786a3d0)
locale: add zh_CN food (#3479) (6c883e7)
locale: update Japanese company categories (#3489) (8c0953a)
locale: update zh_CN animal (#3480) (38ee7b8)
locale: update zh_CN location (#3481) (456f102)
locale: update zh_CN word (#3478) (aa98867)

Changed Locales

locale: ko state data update (#3487) (b611ec2)
locale: normalize internet data (#3502) (e6151e4)
locale: rename pt-BR streetSuffix to streetPrefix (#3493) (7c23db3)

Bug Fixes

locale: correct Japanese country names (#3510) (046bb81)
locale: correct the name of element Lv in Japanese (#3509) (6a7ef4c)
locale: ko modified street_name to street_name_part (#3485) (c15da8e)

`v9.7.0`

Compare Source

New Locales

locale: Add bn_BD locale (#3439) (fef0ad7)
locale: add cy locale, start with date (#3462) (f70a6f7)
locale: add finance support for ja locale (#3449) (b2c5298)
locale: add localize sex support for zh_CN & zh_TW (#3450) (048c325)
locale: add Tamil language support (#3468) (cdf6dc4)

Bug Fixes

airline: Air France and KLM Royal Dutch Airlines (#3440) (8a2d168)
iban: more strict pattern for IE and PS (#3464) (7b12056)
locale: rename ja and zh_CN company affix files (#3448) (1e551c5)
number: don't ignore multipleOf in float when min=max (#3417) (e4cc4e5)

`v9.6.0`

Compare Source

Features

finance: add ISO 4217 numerical codes to Currency (#3404) (ae9aec6)
number: bigint multipleOf (#3402) (7b4f85a)

`v9.5.1`

Compare Source

Bug Fixes

test before using Buffers (#3400) (ec7c9a8)

`v9.5.0`

Compare Source

Features

image: add AI-generated avatars (#3126) (9e13953)

`v9.4.0`

Compare Source

Features

finance: use fake patterns for transactionDescription (#3202) (5ec4a6c)
internet: update to simplified modern user-agent list (#3324) (3c7abb5)
location: add list of spoken languages (#3333) (ff6dda9)

Changed Locales

locale: fix various locale data with trailing spaces (#3329) (e5eec0e)
locale: improve product_name data in en and tr (#3372) (773fc1f)

Bug Fixes

animal: re-moo-ved some incorrect cow data (#3326) (47f835b)
basic wildcard range handling + add more tests (#3322) (817f8a0)
finance: update Discover card number format to ensure accuracy (#3336) (69c0063)
image: dataUri should return random type (#3347) (eceb17d)
locales: update chemical element names in zh_CN (#3371) (6ec6f84)
location: fix bad uz street_name_part data (#3328) (b6132cb)
music: fix truncated song names with commas (#3327) (f36fc71), closes #996
system: semver parts should not be limited to 0-9 (#3349) (c0d92b8)

`v9.3.0`

Compare Source

Features

add initial seed parameter to constructors (#3220) (1633c8d)

Changed Locales

locale: improve zh_CN vehicle manufacturers (#3254) (9abaed1)
locale: lowercase Mexican color names (#3200) (0d85075)
locale: sort person data (#3269) (01e20e9)
locale: split en_AU_ocker first_names by sex (#3270) (b0a5ad3)
locale: split up Spanish generic first names (#3279) (5d5fe30)
locale: update Polish city name (#3306) (53441b7)

Bug Fixes

internet: ensure domainWord always returns a valid value in all locales (#3253) (525fedc)
locale: add Isadora to female names in pt_BR for consistency (#3282) (b390432)
locale: fix incorrect accents in it first_name (#3281) (e0fb23e)

`v9.2.0`

Compare Source

Features

animal: add petName method (#3196) (c02beea)
number: add romanNumeral method (#3070) (72937de)

Changed Locales

locale: improve Spanish color names (#3230) (99d81be)

`v9.1.0`

Compare Source

New Locales

locale: add books on pt_br (#3218) (af1dbcd)
locale: add Swedish(sv) counties (#3154) (67569d9)

Features

add book module (#2949) (2f93d9d)
commerce: more varied product descriptions (#3174) (ba4ef9a)
internet: add jwt method (#2936) (e3858f2)
internet: improve ipv4 method (#2992) (a5a6c5b)
location: add continent method (#3162) (4056ab0)
string: adds support for generating ULID (#2524) (5b1c858)

Changed Locales

locale: enhance en vehicle manufacturers (#3187) (858f8d0)
locale: modernise buzz- and catch-phrases (#2930) (247c86f)
locale: remove inaccessible files (#3205) (89b695c)
locale: trim excessive Croatian last names (#3204) (18e59aa)

Bug Fixes

food: use arrayElement instead of fake for adjective (#3178) (a8dfa2f)
location: fix US ZIP code anomalies for zipCode({state}) (#3180) (df59724)
location: update valid ZIP ranges for FL and VA (#3167) (e271d4a)

`v9.0.3`

Compare Source

Changed Locales

locale: update french legal entity types (#3142) (d6bceb6)

Bug Fixes

image: fix dataUri with type svg-base64 in browsers (#3144) (78b2a3a)

`v9.0.2`

Compare Source

Bug Fixes

locale: improve pt_PT location and person data (#3020) (3e47ee7)

`v9.0.1`

Compare Source

Bug Fixes

emit cts types (#3093) (53ef42c)

`v9.0.0`

Compare Source

No noteworthy changes to 9.0.0-rc.1

For those upgrading from earlier versions, please refer to our Migration Guide for detailed instructions.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-09-20T03:09:53Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: frontend/package-lock.json

npm warn cli npm v12.0.2 does not support Node.js v18.17.1. This version of npm supports the following node versions: `^22.22.2 || ^24.15.0 || >=26.0.0`. You can find the latest version at https://nodejs.org/.
npm error (0 , U.tracingChannel) is not a function
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-09-20T03_09_47_113Z-debug-0.log

renovate Bot added the dependencies Add or update dependencies label Sep 2, 2026

renovate Bot force-pushed the deps-npm-faker-js-faker-vulnerability branch from b223a6c to 7f0ae4a Compare September 7, 2026 22:59

Update dependency @faker-js/faker to v10 [SECURITY]

b2ee997

renovate Bot force-pushed the deps-npm-faker-js-faker-vulnerability branch from 7f0ae4a to b2ee997 Compare September 20, 2026 03:09

Navigation Menu

Update dependency @faker-js/faker to v10 [SECURITY] - #1392

Update dependency @faker-js/faker to v10 [SECURITY]#1392
renovate[bot] wants to merge 1 commit into
mainfrom
deps-npm-faker-js-faker-vulnerability

renovate Bot commented Sep 2, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Sep 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Faker: helpers.fake exploitable into arbritary code execution

Details

Summary

Details

PoC

Impact

Severity

References

Release Notes

New Locales

Features

Bug Fixes

New Locales

Features

Changed Locales

Bug Fixes

New Locales

Features

Changed Locales

Bug Fixes

New Locales

Features

Bug Fixes

New Locales

Bug Fixes

New Locales

Features

Changed Locales

New Locales

Features

New Locales

Changed Locales

Bug Fixes

New Locales

Bug Fixes

Features

Bug Fixes

Features

Features

Changed Locales

Bug Fixes

Features

Changed Locales

Bug Fixes

Features

Changed Locales

New Locales

Features

Changed Locales

Bug Fixes

Changed Locales

Bug Fixes

Bug Fixes

Bug Fixes

Configuration

Uh oh!

renovate Bot commented Sep 20, 2026

⚠️ Artifact update problem

File name: frontend/package-lock.json

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Sep 2, 2026 •

edited

Loading