Microsoft maker.js up to 0.19.1 hasOwnProperty prototype pollution

Summaryinfo

A vulnerability, which was classified as critical, has been found in Microsoft maker.js up to 0.19.1. This affects the function hasOwnProperty. Performing a manipulation results in prototype pollution. This vulnerability was named CVE-2026-24888. The attack may be initiated remotely. There is no available exploit. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability classified as critical has been found in Microsoft maker.js up to 0.19.1. This affects the function hasOwnProperty. The manipulation with an unknown input leads to a prototype pollution vulnerability. CWE is classifying the issue as CWE-1321. The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Maker.js is a 2D vector line drawing and shape modeling for CNC and laser cutters. In versions up to and including 0.19.1, the `makerjs.extendObject` function copies properties from source objects without proper validation, potentially exposing applications to security risks. The function lacks `hasOwnProperty()` checks and does not filter dangerous keys, allowing inherited properties and potentially malicious properties to be copied to target objects. A patch is available in commit 85e0f12bd868974b891601a141974f929dec36b8, which is expected to be part of version 0.19.2.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-24888 since 01/27/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/09/2026). The attack technique deployed by this issue is T1059 according to MITRE ATT&CK.

Applying the patch 85e0f12bd868974b891601a141974f929dec36b8 is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-4851). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• JavaScript Library

Vendor

• Microsoft

Name

• maker.js

Version

• 0.19.0
• 0.19.1

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://github.com/microsoft/maker.js/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion