CVE-2026-24888

Maker.js is a 2D vector line drawing and shape modeling for CNC and laser cutters. In versions up to and including 0.19.1, the `makerjs.extendObject` function copies properties from source objects without proper validation, potentially exposing applications to security risks. The function lacks `hasOwnProperty()` checks and does not filter dangerous keys, allowing inherited properties and potentially malicious properties to be copied to target objects. A patch is available in commit 85e0f12bd868974b891601a141974f929dec36b8, which is expected to be part of version 0.19.2.

• CWE-1321

• https://github.com/microsoft/maker.js/blob/98cffa82a372ff942194c925a12a311253587167/packages/maker.js/src/core/maker.ts#L232-L241Product
• https://github.com/microsoft/maker.js/commit/85e0f12bd868974b891601a141974f929dec36b8Patch
• https://github.com/microsoft/maker.js/security/advisories/GHSA-2cp6-34r9-54xxExploit, Vendor Advisory
• https://github.com/microsoft/maker.js/security/advisories/GHSA-2cp6-34r9-54xxExploit, Vendor Advisory

Published

Jan 28, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24881In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData…9.8
• CVE-2026-24882In GnuPG before 2.5.17, a stack-based buffer overflow exists…7.8
• CVE-2026-24883In GnuPG before 2.5.17, a long signature packet length cause…5.5
• CVE-2026-24884Compressing is a compressing and uncompressing lib for node.…7.8
• CVE-2026-24885Kanboard is project management software focused on Kanban me…8
• CVE-2026-24887Claude Code is an agentic coding tool. Prior to version 2.0.…8.8
• CVE-2026-24889soroban-sdk is a Rust SDK for Soroban contracts. Arithmetic …5.3
• CVE-2026-2489The TP2WP Importer plugin for WordPress is vulnerable to Sto…4.4
• CVE-2026-24890OpenEMR is a free and open source electronic health records …6.5
• CVE-2026-24891openITCOCKPIT is an open source monitoring tool built for di…7.5
• CVE-2026-24892openITCOCKPIT is an open source monitoring tool built for di…8.8
• CVE-2026-24893openITCOCKPIT is an open source monitoring tool built for di…8.8