What’s Vulnerable › Vulnerabilities

CVE-2026-24888: Maker.js Vulnerable to Unsafe Property Copying in makerjs.extendObject

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-28 · updated 2026-06-17
• Weakness: CWE-1321

Description

Maker.js is a 2D vector line drawing and shape modeling for CNC and laser cutters. In versions up to and including 0.19.1, the `makerjs.extendObject` function copies properties from source objects without proper validation, potentially exposing applications to security risks. The function lacks `hasOwnProperty()` checks and does not filter dangerous keys, allowing inherited properties and potentially malicious properties to be copied to target objects. A patch is available in commit 85e0f12bd868974b891601a141974f929dec36b8, which is expected to be part of version 0.19.2.

Affected products

• microsoft maker.js: through 0.19.1
• microsoft maker.js: through 0.19.1

References

• https://github.com/microsoft/maker.js/blob/98cffa82a372ff942194c925a12a311253587167/packages/maker.js/src/core/maker.ts#L232-L241
• https://github.com/microsoft/maker.js/commit/85e0f12bd868974b891601a141974f929dec36b8
• https://github.com/microsoft/maker.js/security/advisories/GHSA-2cp6-34r9-54xx
• https://github.com/microsoft/maker.js/security/advisories/GHSA-2cp6-34r9-54xx

Get alerted when CVE-2026-24888 or the next vulnerability affects your stack