chore(deps): update dependency @faker-js/faker to v10 [security] by renovate[bot] · Pull Request #1094 · csvalpha/amber-ui

renovate · 2026-09-03T06:41:14Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@faker-js/faker (source)	`^7.6.0` → `^10.0.0`

Faker: helpers.fake exploitable into arbritary code execution

CVE-2026-73231 / GHSA-qxc2-j82w-r537

More information

Details

Summary

faker.helpers.fake can be tricked into arbritary code execution.

Details

fakeEval.resolveProperty resolves properties on functions itself instead of resolving the nested function first.
This can be addressed by recursively calling resolveProperty instead of accessing the property after one iteration.

PoC

Go to https://fakerjs.dev/
Open Browser console and run

await enableFaker(); // or import faker
faker.rawDefinitions.test = (() => () => {}); // Any function that returns a function
faker.helpers.fake(`{{test.constructor(alert('PowerLevel: Eval'))}}`);

Impact

The Fake method claims:

It is also NOT possible to use any non-faker methods or plain javascript in such patterns.

Which is objectively false, since any global gets fully accessible in the fake string.

Severity

CVSS Score: 7.8 / 10 (High)
Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

faker-js/faker (@faker-js/faker)

`v10.5.0`

Compare Source

New Locales

locale: add color to cy (#3816) (5a6379f)
locale: add Farsi airline module locale (#3789) (f4a1c3e)
locale: add mn_MN_cyrl (Mongolian) locale (#3796) (d17c0f1)
locale: Add more realistic Greek address data (#3792) (6153eb7)
locale: Add postal_address and improved secondary_address for es (#3798) (6c2a0ab)
locale: add sl_SI locale, location module (#3652) (28d4f7c)
locale: add Welsh (cy) animal type definitions (#3842) (50a5ec9)
locale: add Welsh (cy) book format definitions (#3846) (#3846) (2b32d6e)
locale: add Welsh (cy) building numbers definition (#3892) (4996a2b)
locale: add Welsh (cy) city name definitions (#3884) (ac36c22)
locale: add Welsh (cy) continents definitions (#3880) (03a1682)
locale: add Welsh (cy) county definitions (#3849) (f51d28a)
locale: add Welsh (cy) direction definitions (#3840) (d862071)
locale: add Welsh (cy) internet domain suffix definitions (#3865) (#3865) (fb2e2cb)
locale: add Welsh (cy) phone number definitions (#3878) (70994db)
locale: add Welsh (cy) postal address definitions (#3850) (e72fd7c)
locale: add Welsh (cy) postcode definitions (#3851) (1afbd59)
locale: add Welsh (cy) sex definitions (#3824) (6f29eb7)
locale: add Welsh (cy) state definitions (#3891) (#3891) (606d47c)
locale: add Welsh (cy) street name definitions (#3889) (143789e)
locale: add Welsh (cy) vehicle fuel definitions (#3845) (29c918a)
locale: extend tr person last names (#3839) (f433771)
locale: improved en_GB postcodes (#3864) (a4e5039)
locale: improved en_IE postal_address (#3797) (fb3ffd3)

Features

add first standalone module functions (#3818) (5d4f5de)
date: add ability to provide date range for recent and soon (#3844) (0bc038d)
date: add ability to provide year range for past and future (#3783) (237e7dc)
food: expand plant-based dish and pattern variety (#3887) (5eaf729)
introduce FakerCore (#2838) (68e15d7)
location: add postal address generation (#3760) (753bec6)
number: add distributor functions (#3375) (325e402)
phone: mobile style for phone.number (#3583) (cd5953b)

Bug Fixes

date: incorrect date boundary in past and future (#3827) (0446411)
finance: routingNumber now uses real FederalReserveRoutingSymbol from lookup table. (#3429) (c53c1fe)
food: correct fruit and vegetable locale data (#3800) (30a812a)
handle single-character fromRegExp patterns (#3877) (ec6cc3b)
helpers: ignore wrapper characters in fromRegExp (#3795) (9e2c0e3)
helpers: lazy results in fake (#3852) (5458620)
hide warnings for permanently disabled test stubs (#3860) (03252b9)
link release checklist in release PR workflow (#3802) (8436c4f)
locale: changed farsi phone locales to correct ones (#3775) (5e1ce98)
locale: phone numbers for en_AU (#3788) (eba7d99)
locale: remove citation brackets from snake names (#3822) (bda44d0)
locale: typo in de_CH last name (#3799) (17138d8)
validate unsupported fileExt mime types (#3879) (d11b5d3)

`v10.4.0`

Compare Source

New Locales

locale: add Japanese bear definitions (#3720) (2a4b15c)
locale: add Japanese bird definitions (#3719) (dc31ff8)
locale: add Japanese cat breed definitions (#3716) (54af8a8)
locale: add Japanese cattle breed definitions (#3717) (c2c7342)
locale: add Japanese fish definitions (#3721) (15fc361)
locale: add Japanese horse breed definitions (#3718) (e02536e)
locale: add Norwegian (nb_NO) country definition (#3714) (614b4e9)

Features

fi locale phone numbers (#3747) (7afa8b5)
food: add plant-based dish variety (#3745) (41edf49)

Changed Locales

locale: filter and cleanup PersonEntryDefintions data (#3266) (67defc8)

Bug Fixes

locales: correct typos and capitalization in es_MX street names (#3737) (2b32c28)

`v10.3.0`

Compare Source

New Locales

locale: add Japanese dog definition (#3715) (76c9df1)
locale: add Japanese color definitions (#3707) (bbbb215)
locale: add Japanese food module (#3706) (71d55c0)
locale: add Japanese internet definitions (#3708) (184a709)
locale: add Japanese job definitions for person module (#3705) (e7f3ccd)
locale: add Japanese suffix definitions for person module (#3704) (45ad7d8)
locale: add Norwegian (nb_NO) continent definitions (#3712) (c0f0f23)
locale: add Norwegian (nb_NO) direction definition (#3713) (43b18fa)
locale: add Norwegian (nb_NO) sex definitions (#3710) (76063f2)
locale: add Norwegian (nb_NO) vehicle definition (#3732) (d1c32b0)

Features

locales: add Norwegian (nb_NO) zodiac sign definitions (#3711) (e306542)
person: sexType can return 'generic' (#3259) (0e099a1)
string: support uuid v7 (#3701) (87c2753)

Changed Locales

locale: normalize system locale data (#3702) (ba91653)

Bug Fixes

locale: remove empty string from Hebrew lorem words (#3698) (81a896c)
location: state name to 'Trøndelag' for nb_NO (#3691) (eaef389)

`v10.2.0`

Compare Source

New Locales

locale: add bn_BD location module (#3614) (99a448c)
locale: add counties & states to nb_NO location (#3617) (3dbcbe1)
locale: add da states (regions) (#3656) (78c892b)
locale: add id_ID translation for animal, color, commerce, and word also add country to location id_ID translation. (#3608) (02c2c3e)
locale: add ku_kmr_latin locale (#3629) (247f42d)
locale: add person module data to ku_ckb (#3630) (6be2c20)

Features

Add support for UPC (#3648) (57b2d78)
commerce: allow for locale-specific product name patterns (#3657) (1cf3991)
finance: add IR iban (#3678) (101a74a)
locales: add sl_SI locale, person module (#3564) (e7c9945)
location: Hungarian support for city name, full street address, continents, countries and directions (hu) (#3618) (2c9aefd)

Bug Fixes

food: move raspberry from vegetable to fruit (#3650) (6a4f01f)
locale: endonym should be in Latin script (#3660) (4cda07f)
locale: remove additional inappropriate words from ja locale (#3665) (18a1554)
locale: remove offensive and inappropriate words from ja locale (#3661) (8310c8c)
locale: remove some negative hu words (#3664) (bd36bae)
location: Use accents in en country names (#3637) (24aa11f)
vehicle: Updated spelling Mercielago to Murcielago (#3636) (bfb1bdb)

`v10.1.0`

Compare Source

New Locales

locale: Add ku_ckb locale (#3441) (9de894a)
locale: add Russian localization for book module (#3628) (428ff33)

Bug Fixes

locale: fix the Spring Airlines IATA Code (#3612) (b547045)

`v10.0.0`

Compare Source

New Locales

locale: extended list of colors in Polish (#3586) (9940d54)

Features

locales: add animal vocabulary(bear, bird, cat, rabbit, pet_name) in Korean (#3535) (0d2143c)

Changed Locales

locale: remove invalid credit card issuer patterns (#3568) (9783d95)

`v9.9.0`

Compare Source

New Locales

locale: add word data to pt_br and pt_pt locales (#3531) (a405ac8)

Features

location: simple coordinate methods (#3528) (d07d96d)

`v9.8.0`

Compare Source

New Locales

locale: Add additional Japanese last names to the locale data (#3484) (72e66c3)
locale: add Japanese date and month definitions (#3492) (b70e793)
locale: add Japanese science locale data including elements and units (#3491) (54fd551)
locale: add Japanese sex definitions for person locale (#3495) (1dbd8fa)
locale: add vehicle locale data for Japanese (#3490) (dfadb1d)
locale: add zh_CN book (#3477) (786a3d0)
locale: add zh_CN food (#3479) (6c883e7)
locale: update Japanese company categories (#3489) (8c0953a)
locale: update zh_CN animal (#3480) (38ee7b8)
locale: update zh_CN location (#3481) (456f102)
locale: update zh_CN word (#3478) (aa98867)

Changed Locales

locale: ko state data update (#3487) (b611ec2)
locale: normalize internet data (#3502) (e6151e4)
locale: rename pt-BR streetSuffix to streetPrefix (#3493) (7c23db3)

Bug Fixes

locale: correct Japanese country names (#3510) (046bb81)
locale: correct the name of element Lv in Japanese (#3509) (6a7ef4c)
locale: ko modified street_name to street_name_part (#3485) (c15da8e)

`v9.7.0`

Compare Source

New Locales

locale: Add bn_BD locale (#3439) (fef0ad7)
locale: add cy locale, start with date (#3462) (f70a6f7)
locale: add finance support for ja locale (#3449) (b2c5298)
locale: add localize sex support for zh_CN & zh_TW (#3450) (048c325)
locale: add Tamil language support (#3468) (cdf6dc4)

Bug Fixes

airline: Air France and KLM Royal Dutch Airlines (#3440) (8a2d168)
iban: more strict pattern for IE and PS (#3464) (7b12056)
locale: rename ja and zh_CN company affix files (#3448) (1e551c5)
number: don't ignore multipleOf in float when min=max (#3417) (e4cc4e5)

`v9.6.0`

Compare Source

Features

finance: add ISO 4217 numerical codes to Currency (#3404) (ae9aec6)
number: bigint multipleOf (#3402) (7b4f85a)

`v9.5.1`

Compare Source

Bug Fixes

test before using Buffers (#3400) (ec7c9a8)

`v9.5.0`

Compare Source

Features

image: add AI-generated avatars (#3126) (9e13953)

`v9.4.0`

Compare Source

Features

finance: use fake patterns for transactionDescription (#3202) (5ec4a6c)
internet: update to simplified modern user-agent list (#3324) (3c7abb5)
location: add list of spoken languages (#3333) (ff6dda9)

Changed Locales

locale: fix various locale data with trailing spaces (#3329) (e5eec0e)
locale: improve product_name data in en and tr (#3372) (773fc1f)

Bug Fixes

animal: re-moo-ved some incorrect cow data (#3326) (47f835b)
basic wildcard range handling + add more tests (#3322) (817f8a0)
finance: update Discover card number format to ensure accuracy (#3336) (69c0063)
image: dataUri should return random type (#3347) (eceb17d)
locales: update chemical element names in zh_CN (#3371) (6ec6f84)
location: fix bad uz street_name_part data (#3328) (b6132cb)
music: fix truncated song names with commas (#3327) (f36fc71), closes #996
system: semver parts should not be limited to 0-9 (#3349) (c0d92b8)

`v9.3.0`

Compare Source

Features

add initial seed parameter to constructors (#3220) (1633c8d)

Changed Locales

locale: improve zh_CN vehicle manufacturers (#3254) (9abaed1)
locale: lowercase Mexican color names (#3200) (0d85075)
locale: sort person data (#3269) (01e20e9)
locale: split en_AU_ocker first_names by sex (#3270) (b0a5ad3)
locale: split up Spanish generic first names (#3279) (5d5fe30)
locale: update Polish city name (#3306) (53441b7)

Bug Fixes

internet: ensure domainWord always returns a valid value in all locales (#3253) (525fedc)
locale: add Isadora to female names in pt_BR for consistency (#3282) (b390432)
locale: fix incorrect accents in it first_name (#3281) (e0fb23e)

`v9.2.0`

Compare Source

Features

animal: add petName method (#3196) (c02beea)
number: add romanNumeral method (#3070) (72937de)

Changed Locales

locale: improve Spanish color names (#3230) (99d81be)

`v9.1.0`

Compare Source

New Locales

locale: add books on pt_br (#3218) (af1dbcd)
locale: add Swedish(sv) counties (#3154) (67569d9)

Features

add book module (#2949) (2f93d9d)
commerce: more varied product descriptions (#3174) (ba4ef9a)
internet: add jwt method (#2936) (e3858f2)
internet: improve ipv4 method (#2992) (a5a6c5b)
location: add continent method (#3162) (4056ab0)
string: adds support for generating ULID (#2524) (5b1c858)

Changed Locales

locale: enhance en vehicle manufacturers (#3187) (858f8d0)
locale: modernise buzz- and catch-phrases (#2930) (247c86f)
locale: remove inaccessible files (#3205) (89b695c)
locale: trim excessive Croatian last names (#3204) (18e59aa)

Bug Fixes

food: use arrayElement instead of fake for adjective (#3178) (a8dfa2f)
location: fix US ZIP code anomalies for zipCode({state}) (#3180) (df59724)
location: update valid ZIP ranges for FL and VA (#3167) (e271d4a)

`v9.0.3`

Compare Source

Changed Locales

locale: update french legal entity types (#3142) (d6bceb6)

Bug Fixes

image: fix dataUri with type svg-base64 in browsers (#3144) (78b2a3a)

`v9.0.2`

Compare Source

Bug Fixes

locale: improve pt_PT location and person data (#3020) (3e47ee7)

`v9.0.1`

Compare Source

Bug Fixes

emit cts types (#3093) (53ef42c)

`v9.0.0`

Compare Source

No noteworthy changes to 9.0.0-rc.1

For those upgrading from earlier versions, please refer to our Migration Guide for detailed instructions.

`v8.4.1`

Compare Source

JSDocs improvements

`v8.4.0`

Compare Source

Features

helpers: add support for complex intermediate types (#2550) (24482a3)
number: add parameter fractionDigits in float (#1855) (41d8778)
person: add job titles for fr (#2531) (ba28ab6)

Bug Fixes

finance: correct VG IBAN format (#2552) (b8049d1)
internet: username method to return value that always includes… (#2506) (0ee1c67)
locale: incomplete airline names in zh_CN (#2558) (5525b55)
number: improve float generation for precisions of form 10^-n (#2581) (39c715d)

8.3.1 (2023-11-14)

Bug Fixes

remove [@internal](https://redirect.github.com/internal) from module parent classes (#2548) (77f54ad)

`v8.3.1`

Compare Source

`v8.3.0`

Compare Source

Features

person: use fake patterns for jobTitle (#2528) (b40ad45)

Bug Fixes

date: ensures correct range for birthdate (#2535) (7ce8c28)
finance: maskedNumber has incorrect defaults (#2494) (e0ba50b)
locale: improve Swedish phone numbers format (#2520) (e4865df)

Changed Locales

locale: remove fr_CH data which is identical to fr (#2526) (fafcba4)

New Locales

locale: add person to fr_SN (#2537) (ef965da)
locale: add Senegal locale (#2525) (6df70bc)
locale: add streets to location fr_SN (#2536) (36fc517)
locale: and location to fr_SN (#2533) (f730125)

`v8.2.0`

Compare Source

Features

support custom randomizer (#2284) (5410239)

Bug Fixes

docs: revert filter code that breaks search in docs (#2425) (c498c09)
locale: Dutch phone number (#2400) (005369b)

New Locales

locale: add airline database science commerce and vehicle for zh_CN (#2395) (9c96c0a)
locale: add street_name to en_US, en_GB and en (#2371) (491d319)
locale: add unionpay credit card for zh_CN (#2338) (74eeccc)

`v8.1.0`

Compare Source

Features

color: migrate hu human colors (#2157) (19635a7)
commerce: add method for generating ISBN-10 and ISBN-13 (#2240) (cb4ef28)
image: add image dataUri with base64 (#2273) (869b9b4)
location: add en_IE postcodes (#2149) (e92c313)
location: add ne postcodes (#2148) (36d1d3a)
location: add states for mk (#2271) (1b3e5eb)
location: add states for pt_PT (#2269) (a4631db)
location: add states for sr_RS_latin (#2270) (1de471f)
location: es province should be county (#2156) (bbda1d7)
location: fi addresses (#2146) (1da6785)
location: Support ISO 3166-1 numeric country codes (#2325) (82b779d)
location: update en county list (#2238) (6bb4775)
lorem: seed AR lorem (#2147) (6137801)
metadata: add method to access metadata (#2143) ([fd8cfe5](https://redirect.github.com/faker-js/faker/commit/fd8cfe53fd59b89f91a07327

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Amsterdam)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-09-03T19:05:16Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: yarn.lock

/opt/containerbase/tools/corepack/0.36.0/18.14.2/node_modules/corepack/dist/lib/corepack.cjs:13672
  const isURL = URL.canParse(range);
                    ^

TypeError: URL.canParse is not a function
    at parseSpec (/opt/containerbase/tools/corepack/0.36.0/18.14.2/node_modules/corepack/dist/lib/corepack.cjs:13672:21)
    at Object.getSpec (/opt/containerbase/tools/corepack/0.36.0/18.14.2/node_modules/corepack/dist/lib/corepack.cjs:13841:55)
    at Engine.findProjectSpec (/opt/containerbase/tools/corepack/0.36.0/18.14.2/node_modules/corepack/dist/lib/corepack.cjs:14066:31)
    at async Engine.executePackageManagerRequest (/opt/containerbase/tools/corepack/0.36.0/18.14.2/node_modules/corepack/dist/lib/corepack.cjs:14105:24)
    at async Object.runMain (/opt/containerbase/tools/corepack/0.36.0/18.14.2/node_modules/corepack/dist/lib/corepack.cjs:14838:7)

Node.js v18.14.2

coderabbitai · 2026-09-10T15:40:04Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 38f445a8-090f-46e2-bf0e-487460c83085

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

renovate Bot added the dependencies Pull requests that update a dependency file label Sep 3, 2026

renovate Bot force-pushed the renovate/npm-faker-js-faker-vulnerability branch from e22cb12 to 5a7d7dd Compare September 10, 2026 15:39

chore(deps): update dependency @faker-js/faker to v10 [security]

8aa747d

renovate Bot force-pushed the renovate/npm-faker-js-faker-vulnerability branch from 5a7d7dd to 8aa747d Compare September 15, 2026 13:15

Navigation Menu

Uh oh!

chore(deps): update dependency @faker-js/faker to v10 [security] - #1094

chore(deps): update dependency @faker-js/faker to v10 [security]#1094
renovate[bot] wants to merge 1 commit into
stagingfrom
renovate/npm-faker-js-faker-vulnerability

renovate Bot commented Sep 3, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Sep 3, 2026

Uh oh!

coderabbitai Bot commented Sep 10, 2026 •

edited

Loading

Review skipped

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Faker: helpers.fake exploitable into arbritary code execution

Details

Summary

Details

PoC

Impact

Severity

References

Release Notes

New Locales

Features

Bug Fixes

New Locales

Features

Changed Locales

Bug Fixes

New Locales

Features

Changed Locales

Bug Fixes

New Locales

Features

Bug Fixes

New Locales

Bug Fixes

New Locales

Features

Changed Locales

New Locales

Features

New Locales

Changed Locales

Bug Fixes

New Locales

Bug Fixes

Features

Bug Fixes

Features

Features

Changed Locales

Bug Fixes

Features

Changed Locales

Bug Fixes

Features

Changed Locales

New Locales

Features

Changed Locales

Bug Fixes

Changed Locales

Bug Fixes

Bug Fixes

Bug Fixes

Features

Bug Fixes

8.3.1 (2023-11-14)

Bug Fixes

Features

Bug Fixes

Changed Locales

New Locales

Features

Bug Fixes

New Locales

Features

Configuration

Uh oh!

renovate Bot commented Sep 3, 2026

⚠️ Artifact update problem

File name: yarn.lock

Uh oh!

coderabbitai Bot commented Sep 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

renovate Bot commented Sep 3, 2026 •

edited

Loading

coderabbitai Bot commented Sep 10, 2026 •

edited

Loading