CVE-2026-73231

The CVE refers to Faker.js (faker.helpers.fake in src/modules/helpers/eval.ts) prior to version 10.5.0. A crafted fake template can access the Function constructor via fakeEval.resolveProperty when a function returns another function, enabling arbitrary JavaScript execution. This is fixed in 10.5...

CVE-2026-73231

Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to access the Function constructor through fakeEval.resolveProperty when a function returns another...

CVE-2026-73231 Faker: helpers.fake exploitable into arbritary code execution

Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to access the Function constructor through fakeEval.resolveProperty when a function returns another...

CVE-2026-73231 Faker: helpers.fake exploitable into arbritary code execution

Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to access the Function constructor through fakeEval.resolveProperty when a function returns another...

CVE-2026-73231 Faker: helpers.fake exploitable into arbritary code execution

Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to access the Function constructor through fakeEval.resolveProperty when a function returns another...

PT-2026-70892

Name of the Vulnerable Software and Affected Versions Faker versions prior to 10.5.0 Description The faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to access the Function constructor through fakeEval.resolveProperty when a function returns anoth...

CVE-2026-73231: Improper Neutralization of Directives in Dynamically Evaluated Code

Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to access the Function constructor through fakeEval.resolveProperty when a function returns another...

CVE-2026-71502: Improper Neutralization of Input During Web Page Generation

CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data. An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue...

CVE-2026-71502

CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data. An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue...

Malicious code in express-chai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34482e23635422fb5ca5632e68708453f1c99317a31e5e8346c75c4d3466560f express-chai presents itself as an Express logger middleware impersonating pino, but its exported middleware factory invokes lib/caller.js which...

PT-2026-68816

Name of the Vulnerable Software and Affected Versions CTI-Transmute affected versions not specified Description Stored cross-site scripting occurs due to insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data. An unauthenticated attacker can inje...

MAL-2026-12404 Malicious code in npm-module-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8000a7baeda176481fd23b624485b3e419d6bed7f954900229de069c8ec4e026 The default export getPlugin in index.js performs an HTTPS request to the hardcoded bare-IP endpoint https://46.183.25.232:45000/icons/107 and passes...

Malicious code in npm-module-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8000a7baeda176481fd23b624485b3e419d6bed7f954900229de069c8ec4e026 The default export getPlugin in index.js performs an HTTPS request to the hardcoded bare-IP endpoint https://46.183.25.232:45000/icons/107 and passes...

Malicious code in poly-custom-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3263a9e2a986068fafa530a8e6862f9ba41cad05ecbd5b7b91752ca1c5af0c6 The default export getPlugin in index.js constructs an HTTPS URL from split constants pointing at the bare IP 46.183.25.232:45000/icons/108, fetches...

MAL-2026-12493 Malicious code in utility-kit-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11d4f4654f1acbc26d30e2ea0cae4816bf6e3a847dce2456134d050a38a8a575 The package's default export getPlugin issues a fetch to the hardcoded bare-IP URL https://31.97.137.157:45000/icons/109 and passes the returned...

AWS VDP: RCE in AWS Amplify CLI via Prototype Chain Traversal in amplify-velocity-template

A remote code execution vulnerability was discovered in a template rendering library used by a cloud development framework. The vulnerability existed in the property resolution mechanism, which lacked filtering for prototype chain traversal. This allowed attackers who controlled template files to...

Malicious code in eth-react-redirection (npm)

Source: amazon-inspector cbd414dae34760c2eda09d2093a62a14d694f759350676e88229319a16594e78 On require, index.js calls callCallerAsOrigin which spawns lib/caller.js as a detached, stdio-ignored child process spawnprocess.execPath, script, detached: true, stdio: 'ignore' ; child.unref. The worker...

Malicious code in chai-as-hardened (npm)

Source: amazon-inspector 20c6afe564cf46f02258e635c1b08a802cd4f9b949e098710f44544cdbb86dfd On require, index.js spawns a detached Node child process running lib/initializeCaller.js. That script base64-decodes a hardcoded URL tomato-brunhilda-40.tiiny.site/index.json via atob, fetches the response...

NPM: Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)

NPM: Velocity.js: Remote Code Execution via property-read to Function constructor bypass of GHSA-j658-c2gf-x6pq fix vulnerability discovered by ? in WordPress Npm velocityjs versions = 2.1.6...

Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)

Summary Remote Code Execution RCE in velocityjs v2.1.6 via property-read to the Function constructor. This bypasses the fix for GHSA-j658-c2gf-x6pq "Prototype Pollution in set path assignment" — that advisory blocked constructor/proto/prototype only in the set assignment handler set.cjs, but...