CVE-2026-24888

Katalog CVE

CVSS 9.8 · Critical EPSS 1,0%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pada microsoft maker.js. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Maker.js is a 2D vector line drawing and shape modeling for CNC and laser cutters. In versions up to and including 0.19.1, the `makerjs.extendObject` function copies properties from source objects without proper validation, potentially exposing applications to security risks. The function lacks `hasOwnProperty()` checks and does not filter dangerous keys, allowing inherited properties and potentially malicious properties to be copied to target objects. A patch is available in commit 85e0f12bd868974b891601a141974f929dec36b8, which is expected to be part of version 0.19.2.

Rincian

Terbit di NVD

28 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 62,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/microsoft/maker.js/security/advisories/GHSA-2cp6-34r9-54xx exploit · advisory vendor
• https://github.com/microsoft/maker.js/commit/85e0f12bd868974b891601a141974f929dec36b8 patch
• https://github.com/microsoft/maker.js/blob/98cffa82a372ff942194c925a12a311253587167/packages/maker.js/src/core... product