by Kastro
Paper/Archive/CVE-2026-24888

CVE-2026-24888

microsoft maker.js — Maker.js Vulnerable to Unsafe Property Copying in makerjs.extendObject

EPSS 1.0%public exploitCVSS 9.8
critical.is priorityof 100
52
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 62.7.627 × 2012.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Maker.js is a 2D vector line drawing and shape modeling for CNC and laser cutters. In versions up to and including 0.19.1, the `makerjs.extendObject` function copies properties from source objects without proper validation, potentially exposing applications to security risks. The function lacks `hasOwnProperty()` checks and does not filter dangerous keys, allowing inherited properties and potentially malicious properties to be copied to target objects. A patch is available in commit 85e0f12bd868974b891601a141974f929dec36b8, which is expected to be part of version 0.19.2.

Affected

ProductAffectedFixed inSource
maker.js<= 0.19.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

exploitgithub.com/microsoft/maker.js/security/advisories/GHSA-2cp6-34r9-54xxrefgithub.com/microsoft/maker.js/commit/85e0f12bd868974b891601a141974f929dec36b8refgithub.com/microsoft/maker.js/blob/98cffa82a372ff942194c925a12a311253587167/packages/maker.js/src/core/maker.ts#L232-L241