CVE-2026-24888

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-24888
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24888.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-24888
Aliases
Published
2026-01-28T21:35:44.030Z
Modified
2026-02-10T23:58:12.157710Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Maker.js Vulnerable to Unsafe Property Copying in makerjs.extendObject
Details

Maker.js is a 2D vector line drawing and shape modeling for CNC and laser cutters. In versions up to and including 0.19.1, the makerjs.extendObject function copies properties from source objects without proper validation, potentially exposing applications to security risks. The function lacks hasOwnProperty() checks and does not filter dangerous keys, allowing inherited properties and potentially malicious properties to be copied to target objects. A patch is available in commit 85e0f12bd868974b891601a141974f929dec36b8, which is expected to be part of version 0.19.2.

Database specific 
{
    "cwe_ids": [
        "CWE-1321"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24888.json"
}
References

Affected packages

Git / github.com/microsoft/maker.js

Affected ranges

Type
GIT
Repo
https://github.com/microsoft/maker.js
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
85e0f12bd868974b891601a141974f929dec36b8

Affected versions

0.*
0.1.3
0.2.1
0.5.3
0.6
0.6.11
0.7.0
0.7.1
0.9.10
0.9.17

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24888.json"