Vulnerability-Lookup

CVE-2026-24888 (GCVE-0-2026-24888)

Vulnerability from cvelistv5 – Published: 2026-01-28 21:35 – Updated: 2026-01-29 18:00

Title

Maker.js Vulnerable to Unsafe Property Copying in makerjs.extendObject

Summary

Maker.js is a 2D vector line drawing and shape modeling for CNC and laser cutters. In versions up to and including 0.19.1, the `makerjs.extendObject` function copies properties from source objects without proper validation, potentially exposing applications to security risks. The function lacks `hasOwnProperty()` checks and does not filter dangerous keys, allowing inherited properties and potentially malicious properties to be copied to target objects. A patch is available in commit 85e0f12bd868974b891601a141974f929dec36b8, which is expected to be part of version 0.19.2.

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/microsoft/maker.js/security/ad…	x_refsource_CONFIRM
	https://github.com/microsoft/maker.js/commit/85e0…	x_refsource_MISC
	https://github.com/microsoft/maker.js/blob/98cffa…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	microsoft	maker.js	Affected: <= 0.19.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24888",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-29T16:02:22.958539Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-29T18:00:53.428Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/microsoft/maker.js/security/advisories/GHSA-2cp6-34r9-54xx"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "maker.js",
          "vendor": "microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 0.19.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Maker.js is a 2D vector line drawing and shape modeling for CNC and laser cutters. In versions up to and including 0.19.1, the `makerjs.extendObject` function copies properties from source objects without proper validation, potentially exposing applications to security risks. The function lacks `hasOwnProperty()` checks and does not filter dangerous keys, allowing inherited properties and potentially malicious properties to be copied to target objects. A patch is available in commit 85e0f12bd868974b891601a141974f929dec36b8, which is expected to be part of version 0.19.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-28T21:35:44.030Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/microsoft/maker.js/security/advisories/GHSA-2cp6-34r9-54xx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/microsoft/maker.js/security/advisories/GHSA-2cp6-34r9-54xx"
        },
        {
          "name": "https://github.com/microsoft/maker.js/commit/85e0f12bd868974b891601a141974f929dec36b8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/microsoft/maker.js/commit/85e0f12bd868974b891601a141974f929dec36b8"
        },
        {
          "name": "https://github.com/microsoft/maker.js/blob/98cffa82a372ff942194c925a12a311253587167/packages/maker.js/src/core/maker.ts#L232-L241",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/microsoft/maker.js/blob/98cffa82a372ff942194c925a12a311253587167/packages/maker.js/src/core/maker.ts#L232-L241"
        }
      ],
      "source": {
        "advisory": "GHSA-2cp6-34r9-54xx",
        "discovery": "UNKNOWN"
      },
      "title": "Maker.js Vulnerable to Unsafe Property Copying in makerjs.extendObject"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-24888",
    "datePublished": "2026-01-28T21:35:44.030Z",
    "dateReserved": "2026-01-27T19:35:20.528Z",
    "dateUpdated": "2026-01-29T18:00:53.428Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-24888\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-01-28T22:15:56.517\",\"lastModified\":\"2026-01-29T18:16:17.443\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Maker.js is a 2D vector line drawing and shape modeling for CNC and laser cutters. In versions up to and including 0.19.1, the `makerjs.extendObject` function copies properties from source objects without proper validation, potentially exposing applications to security risks. The function lacks `hasOwnProperty()` checks and does not filter dangerous keys, allowing inherited properties and potentially malicious properties to be copied to target objects. A patch is available in commit 85e0f12bd868974b891601a141974f929dec36b8, which is expected to be part of version 0.19.2.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":2.5}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1321\"}]}],\"references\":[{\"url\":\"https://github.com/microsoft/maker.js/blob/98cffa82a372ff942194c925a12a311253587167/packages/maker.js/src/core/maker.ts#L232-L241\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/microsoft/maker.js/commit/85e0f12bd868974b891601a141974f929dec36b8\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/microsoft/maker.js/security/advisories/GHSA-2cp6-34r9-54xx\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/microsoft/maker.js/security/advisories/GHSA-2cp6-34r9-54xx\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"Maker.js Vulnerable to Unsafe Property Copying in makerjs.extendObject\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-1321\", \"lang\": \"en\", \"description\": \"CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"NONE\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\", \"version\": \"3.1\"}}], \"references\": [{\"name\": \"https://github.com/microsoft/maker.js/security/advisories/GHSA-2cp6-34r9-54xx\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/microsoft/maker.js/security/advisories/GHSA-2cp6-34r9-54xx\"}, {\"name\": \"https://github.com/microsoft/maker.js/commit/85e0f12bd868974b891601a141974f929dec36b8\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/microsoft/maker.js/commit/85e0f12bd868974b891601a141974f929dec36b8\"}, {\"name\": \"https://github.com/microsoft/maker.js/blob/98cffa82a372ff942194c925a12a311253587167/packages/maker.js/src/core/maker.ts#L232-L241\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/microsoft/maker.js/blob/98cffa82a372ff942194c925a12a311253587167/packages/maker.js/src/core/maker.ts#L232-L241\"}], \"affected\": [{\"vendor\": \"microsoft\", \"product\": \"maker.js\", \"versions\": [{\"version\": \"\u003c= 0.19.1\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-01-28T21:35:44.030Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Maker.js is a 2D vector line drawing and shape modeling for CNC and laser cutters. In versions up to and including 0.19.1, the `makerjs.extendObject` function copies properties from source objects without proper validation, potentially exposing applications to security risks. The function lacks `hasOwnProperty()` checks and does not filter dangerous keys, allowing inherited properties and potentially malicious properties to be copied to target objects. A patch is available in commit 85e0f12bd868974b891601a141974f929dec36b8, which is expected to be part of version 0.19.2.\"}], \"source\": {\"advisory\": \"GHSA-2cp6-34r9-54xx\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-24888\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-29T16:02:22.958539Z\"}}}], \"references\": [{\"url\": \"https://github.com/microsoft/maker.js/security/advisories/GHSA-2cp6-34r9-54xx\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-29T16:02:26.579Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-24888\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2026-01-27T19:35:20.528Z\", \"datePublished\": \"2026-01-28T21:35:44.030Z\", \"dateUpdated\": \"2026-01-29T18:00:53.428Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-24888

Vulnerability from fkie_nvd - Published: 2026-01-28 22:15 - Updated: 2026-01-29 18:16

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/microsoft/maker.js/blob/98cffa82a372ff942194c925a12a311253587167/packages/maker.js/src/core/maker.ts#L232-L241
	security-advisories@github.com	https://github.com/microsoft/maker.js/commit/85e0f12bd868974b891601a141974f929dec36b8
	security-advisories@github.com	https://github.com/microsoft/maker.js/security/advisories/GHSA-2cp6-34r9-54xx
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/microsoft/maker.js/security/advisories/GHSA-2cp6-34r9-54xx

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Maker.js is a 2D vector line drawing and shape modeling for CNC and laser cutters. In versions up to and including 0.19.1, the `makerjs.extendObject` function copies properties from source objects without proper validation, potentially exposing applications to security risks. The function lacks `hasOwnProperty()` checks and does not filter dangerous keys, allowing inherited properties and potentially malicious properties to be copied to target objects. A patch is available in commit 85e0f12bd868974b891601a141974f929dec36b8, which is expected to be part of version 0.19.2."
    }
  ],
  "id": "CVE-2026-24888",
  "lastModified": "2026-01-29T18:16:17.443",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-01-28T22:15:56.517",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/microsoft/maker.js/blob/98cffa82a372ff942194c925a12a311253587167/packages/maker.js/src/core/maker.ts#L232-L241"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/microsoft/maker.js/commit/85e0f12bd868974b891601a141974f929dec36b8"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/microsoft/maker.js/security/advisories/GHSA-2cp6-34r9-54xx"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/microsoft/maker.js/security/advisories/GHSA-2cp6-34r9-54xx"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1321"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-2CP6-34R9-54XX

Vulnerability from github – Published: 2026-01-29 15:18 – Updated: 2026-01-29 15:18

Summary

Maker.js has Unsafe Property Copying in makerjs.extendObject

Details

Summary

The makerjs.extendObject function copies properties from source objects without proper validation, potentially exposing applications to security risks. The function lacks hasOwnProperty() checks and does not filter dangerous keys, allowing inherited properties and potentially malicious properties to be copied to target objects.

Details

The extendObject function iterates over source object properties using a for...in loop without: 1. Checking hasOwnProperty() to exclude inherited properties 2. Filtering dangerous keys (__proto__, constructor, prototype) 3. Validating property sources

Affected Code

File: https://github.com/microsoft/maker.js/blob/98cffa82a372ff942194c925a12a311253587167/packages/maker.js/src/core/maker.ts#L232-L241

PoC

const makerjs = require('makerjs');

const source = { __proto__: { name: 'Ravi', isAdmin: true } };
const target = { name: 'user' };
const result = makerjs.extendObject(target, source);

console.log(result.name);  // Ravi
console.log(result.isAdmin);   // true

Impact

Security Implications

Unexpected Behavior: Properties may appear on target objects but not be own properties, breaking hasOwnProperty() assumptions in security-sensitive code.
Security Bypass Risk: Code relying on hasOwnProperty() for validation could be bypassed.
Future Risk: Lack of dangerous key filtering (__proto__, constructor, prototype) exposes potential attack vectors.

Affected Use Cases

Extending objects from user input or external APIs
Merging options from untrusted sources

Severity ?

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.19.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "makerjs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.19.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-24888"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-29T15:18:33Z",
    "nvd_published_at": "2026-01-28T22:15:56Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nThe `makerjs.extendObject` function copies properties from source objects without proper validation, potentially exposing applications to security risks. The function lacks `hasOwnProperty()` checks and does not filter dangerous keys, allowing inherited properties and potentially malicious properties to be copied to target objects.\n\n### Details\nThe `extendObject` function iterates over source object properties using a `for...in` loop without:\n1. Checking `hasOwnProperty()` to exclude inherited properties\n2. Filtering dangerous keys (`__proto__`, `constructor`, `prototype`)\n3. Validating property sources\n\n### Affected Code\n\n**File**: https://github.com/microsoft/maker.js/blob/98cffa82a372ff942194c925a12a311253587167/packages/maker.js/src/core/maker.ts#L232-L241\n\n\n\n### PoC\n```javascript\nconst makerjs = require(\u0027makerjs\u0027);\n\nconst source = { __proto__: { name: \u0027Ravi\u0027, isAdmin: true } };\nconst target = { name: \u0027user\u0027 };\nconst result = makerjs.extendObject(target, source);\n\nconsole.log(result.name);  // Ravi\nconsole.log(result.isAdmin);   // true\n```\n\n\n### Impact\n### Security Implications\n\n1. **Unexpected Behavior**: Properties may appear on target objects but not be own properties, breaking `hasOwnProperty()` assumptions in security-sensitive code.\n\n2. **Security Bypass Risk**: Code relying on `hasOwnProperty()` for validation could be bypassed.\n\n3. **Future Risk**: Lack of dangerous key filtering (`__proto__`, `constructor`, `prototype`) exposes potential attack vectors.\n\n### Affected Use Cases\n\n- Extending objects from user input or external APIs\n- Merging options from untrusted sources",
  "id": "GHSA-2cp6-34r9-54xx",
  "modified": "2026-01-29T15:18:33Z",
  "published": "2026-01-29T15:18:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/microsoft/maker.js/security/advisories/GHSA-2cp6-34r9-54xx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24888"
    },
    {
      "type": "WEB",
      "url": "https://github.com/microsoft/maker.js/commit/85e0f12bd868974b891601a141974f929dec36b8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/microsoft/maker.js"
    },
    {
      "type": "WEB",
      "url": "https://github.com/microsoft/maker.js/blob/98cffa82a372ff942194c925a12a311253587167/packages/maker.js/src/core/maker.ts#L232-L241"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Maker.js has Unsafe Property Copying in makerjs.extendObject"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-24888 (GCVE-0-2026-24888)

FKIE_CVE-2026-24888

GHSA-2CP6-34R9-54XX

Summary

Details

Affected Code

PoC

Impact

Security Implications

Affected Use Cases

Tags

Sightings

Nomenclature