Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability description clearly states that the faker.helpers.fake method, specifically through fakeEval.resolveProperty in src/modules/helpers/eval.ts, allowed access to the Function constructor, leading to arbitrary code execution. The provided commit 54586208f904012f57c50b46cc1ad32bcbe4bfb7 shows a direct modification to the resolveProperty function within src/modules/helpers/eval.ts. The change removes a direct property access (entrypoint?.[key as keyof typeof entrypoint]) and replaces it with a recursive call to resolveProperty(entrypoint, key). This indicates that the direct property access was the vulnerable part, allowing the bypass of security checks and access to the Function constructor. Therefore, fakeEval.resolveProperty is the function that contained the vulnerability.
fakeEval.resolvePropertysrc/modules/helpers/eval.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @faker-js/faker | npm | <= 10.4.0 | 10.5.0 |