Read the docs
TI-2026-20073 Aliases CVE-2026-24888GHSA-2cp6-34r9-54xx

Maker.js Vulnerable to Unsafe Property Copying in makerjs.extendObject

Priority HIGH 81CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Maker.js is a 2D vector line drawing and shape modeling for CNC and laser cutters. In versions up to and including 0.19.1, the `makerjs.extendObject` function copies properties from source objects without proper validation, potentially exposing applications to security risks. The function lacks `hasOwnProperty()` checks and does not filter dangerous keys, allowing inherited properties and potentially malicious properties to be copied to target objects. A patch is available in commit 85e0f12bd868974b891601a141974f929dec36b8, which is expected to be part of version 0.19.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00997 62nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed makerjs (npm): 0.19.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Microsoftmaker.jsup to 0.19.1—No fix listedCNA
—makerjs (npm)before 0.19.20.19.2Patch availableGHSA-2cp6-34r9-54xx
  • maker.js VendorMicrosoft Affected up to 0.19.1 Fixed in — No fix listed CNA
  • makerjs (npm) Vendor— Affected before 0.19.2 Fixed in 0.19.2 Patch available GHSA-2cp6-34r9-54xx

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:maker.js:*:*:*:*:*:node.js:*:*up to 0.19.1VulnerableMicrosoft
  • cpe:2.3:a:microsoft:maker.js:*:*:*:*:*:node.js:*:* Versions up to 0.19.1 Vulnerable ·Microsoft

Remediation

  • Fix · GHSA-2cp6-34r9-54xx makerjs (npm) Fixed in 0.19.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-24888
  2. 2026-10-03 Alias added: GHSA-2cp6-34r9-54xx

References

Exploit 1

Patch 1

Advisory 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences