The faker.helpers.fake method in older versions of the faker-js:faker library allowed attacker‑controlled fake templates to invoke the JavaScript Function constructor through the fakeEval.resolveProperty helper. This enabled the execution of arbitrary JavaScript code when a function returned another function. The issue is a classic code‑injection flaw (CWE‑94 and CWE‑95) and can lead to full compromise of the JavaScript environment in which Faker is executed.

Any Node.js or browser application that imports faker-js:faker prior to version 10.5.0 and uses the helpers.fake API is affected. Versions prior to 10.5.0 are vulnerable; all releases starting with 10.5.0 contain the fix.

The CVSS score of 7.8 assigns high severity. The EPSS score of less than 1% suggests a very low likelihood of real‑world exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be template injection: an attacker must supply a malicious fake template string or otherwise influence the template passed to helpers.fake, which is then evaluated with the Function constructor. No external network channel is required, so the vulnerability is likely limited to contexts where template strings can be injected or crafted by an attacker.