Microsoft maker.js is a JavaScript library used for 2D vector line drawing and shape modeling, particularly in CNC and laser cutting applications. Versions up to and including 0.19.1 contain a prototype pollution vulnerability identified as CVE-2026-24888 (CWE-1321). The root cause is the makerjs.extendObject function, which merges properties from source objects into target objects without verifying if those properties are own properties of the source object. Specifically, the function lacks hasOwnProperty() checks and does not filter out dangerous keys, enabling attackers to inject or modify prototype attributes. This improper handling allows malicious actors to manipulate the prototype chain, potentially altering application behavior, bypassing security controls, or corrupting data structures. The vulnerability can be exploited remotely without authentication or user interaction, increasing the attack surface. Although no known exploits have been reported in the wild, the issue poses a tangible risk to applications relying on maker.js for critical manufacturing or design processes. A patch addressing this vulnerability has been committed (commit 85e0f12bd868974b891601a141974f929dec36b8) and is expected in version 0.19.2. The CVSS 3.1 base score is 6.5, reflecting a medium severity level due to the potential impact on confidentiality and integrity but no impact on availability.

For European organizations, especially those in manufacturing, industrial design, and CNC/laser cutting sectors, this vulnerability could lead to unauthorized modification of design data or application logic, potentially causing defective product outputs or intellectual property exposure. The integrity of design files and manufacturing instructions could be compromised, leading to financial losses, production delays, or safety hazards if maliciously altered. Confidential information embedded in design metadata might also be exposed or manipulated. Since maker.js is a specialized library, the impact is concentrated on organizations integrating it into their design or manufacturing pipelines. Disruption or manipulation of these processes could have downstream effects on supply chains and product quality. Given the remote exploitability without authentication, attackers could target vulnerable systems over the internet or internal networks, increasing risk for organizations with exposed development or manufacturing environments.

European organizations using maker.js should immediately upgrade to version 0.19.2 or later, which includes the patch for this vulnerability. If upgrading is not immediately feasible, implement strict input validation and sanitization on any data passed to makerjs.extendObject to prevent malicious prototype properties from being introduced. Employ runtime security controls such as JavaScript sandboxing or object freezing to limit prototype chain modifications. Conduct thorough code reviews and dependency audits to identify and remediate usage of vulnerable versions. Additionally, restrict network access to development and manufacturing systems using maker.js to trusted users and networks only. Monitor logs for unusual object property manipulations or errors indicative of prototype pollution attempts. Finally, educate developers on secure coding practices related to object property handling to prevent similar issues.