PT-2026-5230 · Maker.Js · Maker.Js

Hayageek · Published 2026-01-28 · Updated 2026-02-09 · CVE-2026-24888

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Maker.js versions up to and including 0.19.1

Description Maker.js is a 2D vector line drawing and shape modeling library for CNC and laser cutters. The makerjs.extendObject function copies properties from source objects without proper validation. Specifically, the function lacks hasOwnProperty() checks and does not filter dangerous keys, allowing inherited and potentially malicious properties to be copied to target objects. This can expose applications to security risks.

Recommendations Update to a version later than 0.19.1, such as version 0.19.2, which includes a fix available in commit 85e0f12bd868974b891601a141974f929dec36b8.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-24888

GHSA-2CP6-34R9-54XX

Affected Products

Maker.Js

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24888.json · Exploit
• 🔥 https://github.com/microsoft/maker.js/security/advisories/GHSA-2cp6-34r9-54xx · Exploit
• https://github.com/microsoft/maker.js/commit/85e0f12bd868974b891601a141974f929dec36b8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-24888 · Security Note
• https://osv.dev/vulnerability/GHSA-2cp6-34r9-54xx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24888 · Vendor Advisory
• https://github.com/microsoft/maker.js/blob/98cffa82a372ff942194c925a12a311253587167/packages/maker.js/src/core/maker.ts#L232-L241 · Note
• https://github.com/microsoft/maker.js · Note
• https://t.me/cveNotify/151445 · Telegram Post
• https://t.me/CVEtracker/43205 · Telegram Post
• https://twitter.com/0dayPublishing/status/2016631477715292313 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2016640237665972562 · Twitter Post
• https://twitter.com/CVEnew/status/2016631014437900376 · Twitter Post