CVE-2026-24888: Maker.js Unsafe Property Copying Vulnerability

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

Maker.js is a JavaScript library designed for creating and manipulating vector graphics. It provides a range of functionalities for developers to work with geometrical shapes and paths, making it useful for applications that require dynamic graphic generation. However, the library has a vulnerability in its extendObject function, which can lead to security risks when properties are copied from source objects without proper validation.

Vulnerability Detail

The vulnerability in Maker.js arises from the extendObject function, which copies properties from source objects using a for...in loop without adequate checks. Specifically, it does not utilize hasOwnProperty() to filter out inherited properties, nor does it block dangerous keys such as __proto__, constructor, and prototype. This oversight can lead to unexpected behavior in applications, allowing potentially malicious properties to be copied to target objects, which can compromise security assumptions in code that relies on hasOwnProperty() for validation.

npm install makerjs@0.19.2

Workaround

As a temporary workaround, you can manually filter properties when using the extendObject function. Here is an example of how to do this:

const makerjs = require('makerjs');

function safeExtendObject(target, source) {
    for (let key in source) {
        if (source.hasOwnProperty(key) && !['__proto__', 'constructor', 'prototype'].includes(key)) {
            target[key] = source[key];
        }
    }
    return target;
}

const source = { __proto__: { name: 'Ravi', isAdmin: true } };
const target = { name: 'user' };
const result = safeExtendObject(target, source);

console.log(result.name);

// user

console.log(result.isAdmin);

// undefined

Conclusion

The Maker.js library has a vulnerability in its extendObject function that allows unsafe property copying, which can lead to security risks. It is crucial to update to version 0.19.2 or later to mitigate these risks. Alternatively, a manual filtering workaround can be implemented until an update is possible.

See every vulnerability recorded for makerjs →

FAQ