6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24888

CVE-2026-24888: Maker.js Vulnerable to Unsafe Property Copying in makerjs.extendObject

Maker.js is a 2D vector line drawing and shape modeling for CNC and laser cutters. In versions up to and including 0.19.1, the makerjs.extendObject function copies properties from source objects without proper validation, potentially exposing applications to security risks. The function lacks hasOwnProperty() checks and does not filter dangerous keys, allowing inherited properties and potentially malicious properties to be copied to target objects. A patch is available in commit 85e0f12bd868974b891601a141974f929dec36b8, which is expected to be part of version 0.19.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24888

CVE-2026-24888:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
makerjs	npm	<= 0.19.1	0.19.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the extendObject function in maker.js. The function's purpose is to copy properties from one object to another. The vulnerability, a form of prototype pollution, exists because the function did not properly validate the properties being copied. Specifically, it failed to check if the properties were 'own' properties of the source object and did not block dangerous property names. An attacker could provide a crafted object as the source, leading to the modification of the prototype of the base Object in JavaScript. This could lead to a variety of security issues, such as bypassing security checks or causing the application to behave unexpectedly. The provided patch addresses this by adding a check for hasOwnProperty to ensure only the object's own properties are copied, and by explicitly blocking the copying of __proto__, constructor, and prototype properties.

Vulnerable functions

makerjs.extendObject

packages/maker.js/src/core/maker.ts

The `extendObject` function is vulnerable to prototype pollution. It iterates over properties of a source object and copies them to a target object. The original implementation used a `for...in` loop without checking if the property belonged to the object itself or its prototype using `hasOwnProperty`. This allows an attacker to add or modify properties of the `Object.prototype` by crafting a malicious source object. The patch mitigates this by adding a `hasOwnProperty` check and filtering for dangerous keys like `__proto__`, `constructor`, and `prototype`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.