CVSS 3.1
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Атакува се
Време до експлоатация
Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.
- Експлоатация: има публичен пример за експлоатация
- Атаката може да се автоматизира
Описание
Оригинално описание
Maker.js is a 2D vector line drawing and shape modeling for CNC and laser cutters. In versions up to and including 0.19.1, the `makerjs.extendObject` function copies properties from source objects without proper validation, potentially exposing applications to security risks. The function lacks `hasOwnProperty()` checks and does not filter dangerous keys, allowing inherited properties and potentially malicious properties to be copied to target objects. A patch is available in commit 85e0f12bd868974b891601a141974f929dec36b8, which is expected to be part of version 0.19.2.
Засегнати продукти
- microsoft maker.js: <= 0.19.1
Вид слабост
История
- 28 януари 2026 Публикувано
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-24888
- https://nvd.nist.gov/vuln/detail/CVE-2026-24888
- https://github.com/microsoft/maker.js/security/advisories/GHSA-2cp6-34r9-54xx
- https://github.com/microsoft/maker.js/commit/85e0f12bd868974b891601a141974f929dec36b8
- https://github.com/microsoft/maker.js/blob/98cffa82a372ff942194c925a12a311253587167/packages/maker.js/src/core/maker.ts#L232-L241