Vulnerability in Maker.js Affects Functionality of 2D Vector Drawing Software
CVE-2026-24888

6.5MEDIUM

Key Information:

Vendor

Microsoft
Status
Maker.js
Vendor
CVE Published:
28 January 2026

What is CVE-2026-24888?

Maker.js, a tool designed for 2D vector line drawing and shape modeling specifically for CNC and laser cutters, has a vulnerability in the makerjs.extendObject function that allows the copying of properties from source objects without sufficient validation. This flaw means that unsafe properties, including potentially malicious inherited properties, can be copied into target objects, leading to significant security risks. The issue arises from the absence of hasOwnProperty() checks and the lack of filtration for harmful keys. Developers are urged to upgrade to the patched version 0.19.2 to mitigate this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

maker.js <= 0.19.1

References

https://github.com/microsoft/maker.js/security/advisories...
x_refsource_CONFIRM
https://github.com/microsoft/maker.js/commit/85e0f12bd868...
x_refsource_MISC
https://github.com/microsoft/maker.js/blob/98cffa82a372ff...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.