CVE-2026-24888

CVE-2026-24888 is a vulnerability in Maker.js, a JavaScript library for 2D vector line drawing and shape modeling used with CNC and laser cutters. In versions up to and including 0.19.1, the `makerjs.extendObject` function copies properties from source objects to target objects without proper validation. It lacks `hasOwnProperty()` checks and does not filter dangerous keys, allowing inherited properties and potentially malicious properties to be copied, which aligns with CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes, or prototype pollution). The issue carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) and was published on 2026-01-28.

The vulnerability enables exploitation over the network with low attack complexity, requiring no privileges, no user interaction, and no change in scope. Any remote attacker can leverage it if untrusted input reaches the `makerjs.extendObject` function, such as through parsed files or data in web applications using Maker.js. Successful exploitation allows low-impact confidentiality and integrity violations, typically by polluting object prototypes and altering application behavior.

Mitigation is addressed in GitHub commit 85e0f12bd868974b891601a141974f929dec36b8, expected to be included in Maker.js version 0.19.2. Security practitioners should update to the patched version and review the GitHub security advisory GHSA-2cp6-34r9-54xx for further details. The vulnerable code is visible in the maker.ts source at lines 232-241 prior to the fix.