CVE-2026-24888
📋 TL;DR
Maker.js versions up to 0.19.1 contain a prototype pollution vulnerability in the extendObject function that allows attackers to modify object prototypes by copying malicious properties. This affects applications using Maker.js for 2D vector drawing and shape modeling, potentially leading to denial of service or remote code execution. The vulnerability is present in any application that uses the vulnerable extendObject function with untrusted input.
💻 Affected Systems
- Maker.js
📦 What is this software?
Maker.js by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution through prototype pollution leading to complete system compromise of applications using Maker.js.
Likely Case
Denial of service through application crashes or unexpected behavior modification in applications using Maker.js.
If Mitigated
Limited impact if applications don't process untrusted input through extendObject or have input validation layers.
🎯 Exploit Status
Exploitation requires the application to process attacker-controlled data through the vulnerable function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.19.2 (or later)
Vendor Advisory: https://github.com/microsoft/maker.js/security/advisories/GHSA-2cp6-34r9-54xx
Restart Required: Yes
Instructions:
1. Update Maker.js to version 0.19.2 or later using npm update makerjs. 2. Restart any applications using Maker.js. 3. Verify the update was successful.
🔧 Temporary Workarounds
Input validation wrapper
allCreate a wrapper function that validates input before passing to extendObject
// JavaScript code to wrap extendObject calls with validation
function safeExtendObject(target, source) {
if (!source || typeof source !== 'object') return target;
// Add validation logic here
return makerjs.extendObject(target, source);
}
🧯 If You Can't Patch
- Implement strict input validation for all data passed to extendObject function
- Isolate Maker.js usage to trusted data sources only
🔍 How to Verify
Check if Vulnerable:
Check package.json for makerjs version <=0.19.1 or examine node_modules/makerjs/package.jsonCheck Version:
npm list makerjsVerify Fix Applied:
Verify makerjs version is >=0.19.2 in package.json and check that extendObject includes hasOwnProperty checks📡 Detection & Monitoring
Log Indicators:
- Unexpected application crashes
- Unusual object property modifications
- Prototype pollution warnings in logs
Network Indicators:
- Unusual data patterns in requests to applications using Maker.js
SIEM Query:
Search for error logs containing 'prototype pollution', 'extendObject', or Maker.js-related crashes🔗 References
- https://github.com/microsoft/maker.js/blob/98cffa82a372ff942194c925a12a311253587167/packages/maker.js/src/core/maker.ts#L232-L241
- https://github.com/microsoft/maker.js/commit/85e0f12bd868974b891601a141974f929dec36b8
- https://github.com/microsoft/maker.js/security/advisories/GHSA-2cp6-34r9-54xx
- https://github.com/microsoft/maker.js/security/advisories/GHSA-2cp6-34r9-54xx
