CyberRota Analysis
AI-GeneratedThe Faker library for Java, prior to version 10.5.0, contains a vulnerability in the faker.helpers.fake method that allows attackers to execute arbitrary JavaScript code by manipulating fake templates. This could lead to severe security breaches, including unauthorized access to sensitive data or system compromise. Developers using affected versions of Faker should prioritize upgrading to version 10.5.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to access the Function constructor through fakeEval.resolveProperty when a function returns another function, enabling arbitrary JavaScript code execution. This issue is fixed in version 10.5.0.