CVE-2026-24888: 
JavaScript vulnerability analysis and mitigation

CVE-2026-24888 is a prototype pollution vulnerability in Microsoft's Maker.js library, a 2D vector line drawing and shape modeling tool for CNC and laser cutters. The flaw exists in the makerjs.extendObject function, which copies properties from source objects without proper validation, allowing inherited or malicious properties to be injected into target objects. All versions up to and including 0.19.1 of the makerjs npm package are affected. The vulnerability was published on January 28, 2026, with a patch committed the same day. The GitHub Advisory Database assigns a CVSS v3.1 score of 6.5 (Moderate), while NVD initially scored it 9.8 (Critical) (Github Advisory, GitHub Security Advisory).

The root cause is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes — Prototype Pollution). The vulnerable extendObject function in packages/maker.js/src/core/maker.ts (lines 232–241) iterates over source object properties using a for...in loop without calling hasOwnProperty() to exclude inherited properties, and without filtering dangerous keys such as __proto__, constructor, or prototype. An attacker who can supply a crafted object as the other parameter — for example, via user-controlled input passed to any API that internally calls extendObject — can inject arbitrary properties onto the target object and potentially onto Object.prototype itself. The attack requires no privileges or user interaction and is reachable over the network in server-side Node.js deployments (Github Advisory, Patch Commit).

Vulnerable code snippet:

export function extendObject(target: Object, other: Object) {
  if (target && other) {
    for (var key in other) {
      if (typeof other[key] !== 'undefined') {
        target[key] = other[key];
      }
    }
  }
  return target;
}

Successful exploitation can compromise the confidentiality and integrity of applications that use Maker.js to process untrusted input. By polluting Object.prototype, an attacker may cause unexpected behavior across all objects in the application, potentially bypassing hasOwnProperty()-based security checks, escalating privileges (e.g., injecting isAdmin: true), or manipulating application logic in vector drawing and modeling operations. Availability impact is assessed as none by the authoritative GitHub advisory, though integrity and confidentiality are both rated as low-to-moderate; the risk is highest in applications that pass user-supplied or external API data directly to extendObject (Github Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory itself, demonstrating that passing an object with a crafted __proto__ property to makerjs.extendObject causes inherited properties to appear on the target object (GitHub Security Advisory). As of the time of disclosure, there is no evidence of active in-the-wild exploitation, and no threat actor attribution has been reported. The EPSS score is approximately 0.637% (71st percentile), indicating a relatively low but non-negligible probability of exploitation within 30 days (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Identify target: Locate a Node.js application that uses the makerjs npm package at version ≤ 0.19.1 and exposes an endpoint or API that accepts user-controlled JSON or object data passed to any function internally calling makerjs.extendObject.
2. Craft malicious payload: Construct a JavaScript object with a poisoned __proto__ property containing attacker-controlled key-value pairs, e.g.:

const source = { __proto__: { isAdmin: true, role: 'superuser' } };

3. Deliver payload: Submit the crafted object as input to the vulnerable application endpoint. The application passes this object (or a derivative) as the other argument to makerjs.extendObject.
4. Trigger prototype pollution: The for...in loop in extendObject iterates over inherited properties from __proto__ and assigns them to the target object, polluting Object.prototype or the target's prototype chain.
5. Achieve objective: Downstream code that relies on hasOwnProperty() checks or trusts properties like isAdmin on arbitrary objects may now behave incorrectly, enabling privilege escalation, security bypass, or manipulation of application logic (Github Advisory, GitHub Security Advisory).

• Logs: Unexpected property values (e.g., isAdmin: true, role: 'superuser') appearing in application logs for objects that should not have those properties; errors or stack traces related to unexpected prototype chain modifications.
• Application Behavior: Authorization checks unexpectedly passing for unprivileged users; application logic behaving inconsistently across requests due to polluted Object.prototype.
• Network: HTTP requests to Maker.js-consuming endpoints containing JSON payloads with __proto__, constructor, or prototype keys in request bodies or query parameters.
• File System / Process: No specific file system or process-level IOCs are known for this vulnerability, as exploitation is purely in-memory and application-logic-based.

Upgrade the makerjs npm package to version 0.19.2 or later, which includes the fix from commit 85e0f12bd868974b891601a141974f929dec36b8. The patch adds hasOwnProperty() checks and filters dangerous keys (__proto__, constructor, prototype) in the extendObject function (Patch Commit, Github Advisory). If immediate patching is not possible, restrict network access to affected services, implement input validation to reject objects containing __proto__, constructor, or prototype keys before they reach Maker.js APIs, and audit all code paths that pass external or user-supplied data to makerjs.extendObject.

The vulnerability was reported by security researcher hayageek and published by Maker.js maintainer danmarshall on January 28, 2026. The GitHub Advisory Database rated it Moderate (6.5), while NVD initially assigned a Critical score (9.8), reflecting some disagreement on severity between sources. No significant broader media coverage or notable community debate beyond the advisory itself has been identified (Github Advisory, GitHub Security Advisory).