CVE Intelligence
Analysis AI-assisted

CVE-2026-24888: Microsoft Maker.js prototype pollution in extendObject

Maker.js, a Microsoft library for 2D vector drawing and shape modeling aimed at CNC and laser cutters, has a prototype pollution weakness (CWE-1321) in its extendObject function in versions up to and including 0.19.1. The function copies properties without hasOwnProperty checks and without filtering dangerous keys. A patch exists in a commit that is expected to ship in version 0.19.2.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-24888 affects Microsoft Maker.js, a JavaScript library for 2D vector line drawing and shape modeling aimed at CNC and laser cutters. The weakness is classified as prototype pollution (CWE-1321) in the extendObject function, which copies properties from source objects without the checks that would normally limit what gets copied.

Impact

The record states that the flaw could potentially expose applications to security risks. Because the function copies inherited properties and does not filter dangerous keys, malicious properties may be written into target objects. The specific consequences depend on how an application uses the function and are not detailed in the available sources.

  • NVD lists a CVSS 3.1 base score of 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • The GitHub CNA entry in the record lists a CVSS 3.1 score of 6.5.

Affected products and versions

  • Microsoft Maker.js, versions up to and including 0.19.1.
  • The record does not confirm a released fixed version. The patch commit is expected to be part of version 0.19.2.

Exploitation status

The CISA KEV catalog does not list this CVE. No confirmed exploitation appears in the sources consulted. The GitHub advisory reference carries an Exploit tag in the record, but the record does not describe any exploitation activity, so this tag should be verified against the advisory itself.

Remediation and mitigation

  • Plan an upgrade to Maker.js 0.19.2 or a later release once the release is published and confirmed by the vendor advisory.
  • Until then, review the patch commit and assess whether it can be applied to the deployed version.
  • Review application code that passes data from untrusted sources into extendObject, and limit such input to trusted data where possible.
  • Validate and restrict object keys before merging them into other objects, as a defensive design measure.

Detection guidance

  • Inventory applications and build pipelines that depend on Maker.js and record the installed version.
  • Look for unexpected properties or behavior changes in objects that receive merged data, which may indicate prototype pollution.
  • Monitor the vendor advisory and package feeds for the 0.19.2 release.

Limitations of the available information

The record does not confirm a fixed version. The CVSS scores differ between NVD and the CNA. No EPSS or SSVC data is available. The sources do not describe a concrete exploitation scenario or downstream affected products beyond Maker.js itself.

Frequently asked questions

Is CVE-2026-24888 being actively exploited?

The CISA KEV catalog does not list this CVE, and no confirmed exploitation appears in the sources consulted.

Which Maker.js versions are affected and what should I do?

Versions up to and including 0.19.1 are listed as affected. Plan an upgrade to 0.19.2 or later once it is published and confirmed by the vendor advisory, and review how your code passes data into extendObject in the meantime.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.