PT-2026-5230 · Maker.Js · Maker.Js

Hayageek · Publicado 2026-01-28 · Atualizado 2026-02-09 · CVE-2026-24888

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Maker.js versions up to and including 0.19.1

Description Maker.js is a 2D vector line drawing and shape modeling library for CNC and laser cutters. The makerjs.extendObject function copies properties from source objects without proper validation. Specifically, the function lacks hasOwnProperty() checks and does not filter dangerous keys, allowing inherited and potentially malicious properties to be copied to target objects. This can expose applications to security risks.

Recommendations Update to a version later than 0.19.1, such as version 0.19.2, which includes a fix available in commit 85e0f12bd868974b891601a141974f929dec36b8.

Exploit

Correção

Prototype Pollution

Enumeração de Fraquezas

CWE-1321

Identificadores relacionados

CVE-2026-24888

GHSA-2CP6-34R9-54XX

Produtos afetados

Maker.Js

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24888.json · Exploit
• 🔥 https://github.com/microsoft/maker.js/security/advisories/GHSA-2cp6-34r9-54xx · Exploit
• https://github.com/microsoft/maker.js/commit/85e0f12bd868974b891601a141974f929dec36b8 · Correção
• https://github.com/microsoft/maker.js/blob/98cffa82a372ff942194c925a12a311253587167/packages/maker.js/src/core/maker.ts#L232-L241 · Nota
• https://github.com/microsoft/maker.js · Nota
• https://t.me/cveNotify/151445 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-24888 · Nota de Segurança
• https://t.me/CVEtracker/43205 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-2cp6-34r9-54xx · Aviso do Fabricante
• https://twitter.com/0dayPublishing/status/2016631477715292313 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2016640237665972562 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-24888 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2016631014437900376 · Publicação no Twitter