CVE-2026-24888 Maker.js Vulnerable to Unsafe Property Copying in makerjs.extendObject
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-24888?
CVE-2026-24888 is a medium-severity vulnerability in microsoft maker.js, published on 28 Jan 2026.
Official description
Maker.js is a 2D vector line drawing and shape modeling for CNC and laser cutters. In versions up to and including 0.19.1, the `makerjs.extendObject` function copies properties from source objects without proper validation, potentially exposing applications to security risks. The function lacks `hasOwnProperty()` checks and does not filter dangerous keys, allowing inherited properties and potentially malicious properties to be copied to target objects. A patch is available in commit 85e0f12bd868974b891601a141974f929dec36b8, which is expected to be part of version 0.19.2.
Weakness: CWE-1321
Which versions are affected by CVE-2026-24888?
2 open source packages ship an affected version, including makerjs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
makerjs npm | All versions | 0.19.2 |
makerjs npm | All versions | 0.19.2 |
Products include Microsoft Maker.js.
How do I fix CVE-2026-24888?
Upgrade makerjs to 0.19.2 or later.
Is CVE-2026-24888 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-24888 exists.
Sources
Also known as GHSA-2cp6-34r9-54xx.