CVE-2026-24888 is a medium severity flaw (CVSS 6.5) in Maker.js, the 2D vector drawing library for CNC and laser cutters. Its extendObject function copies properties from a source object without checking where they come from or filtering dangerous keys. It affects versions up to and including 0.19.1, and the advisory lists no patched release yet.
What's affected
- Affected: the makerjs npm package, versions up to and including 0.19.1.
- Fixed in: the advisory lists no patched version. The NVD record says a patch is in commit 85e0f12bd868974b891601a141974f929dec36b8 and expected to ship in 0.19.2. Check npm and the project's releases to see whether 0.19.2 is out.
The advisory says the risk applies when you extend objects from user input or external APIs, or merge options from untrusted sources.
How to check if you're exposed
Find out whether the package is in your dependency tree, including as a transitive dependency.
npm ls makerjs
Then search your own code for calls to extendObject, and ask where the second argument comes from. If it is always an object you built yourself, you are in a much better position than if it comes from a request body, a file a user uploaded or a third party API.
What to do now
- Check for makerjs 0.19.2 or later, and upgrade when it is published and the release notes confirm the fix.
- Until then, do not pass untrusted objects into extendObject. Copy only the keys you expect.
- Where you must merge external data, parse it into a plain structure first and drop the keys proto, constructor and prototype.
- Review other merge helpers in your code, because the same pattern appears in many libraries.
Why it matters
The function walks every property of the source object, including inherited ones, and does not check that the property belongs to the object. The advisory's concern is that properties can appear on the target that are not its own, breaking code that relies on own property checks. It lists a security bypass risk when validation depends on those checks.
The class is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes). It is a quiet bug. It rarely shows up in testing and becomes dangerous when untrusted input reaches a merge. Whether it matters for you depends on reachability, which is the question of whether any code path in your application actually delivers untrusted data to the function.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2026-24888 critical?
No. The advisory rates it moderate, at CVSS 6.5. It is included here because it sits in a library that merges objects, which is a common route to bigger problems.
Is it exploited in the wild?
The record does not list it on the CISA Known Exploited Vulnerabilities catalog, and the advisory does not report exploitation.
Sources
Last reviewed: 19 October 2026.
