Executive brief
Maker.js is a vector drawing and shape modeling library used by CNC and laser cutter applications. The extendObject function, commonly used to merge configuration options, does not properly validate property sources and can be exploited to pollute an object's prototype chain. An attacker can inject malicious properties through object extensions, potentially bypassing security checks that applications rely on and leading to unauthorized property access or behavior modification.
Technical details
The vulnerability is a prototype pollution weakness (CWE-1321) in the extendObject function (src/core/maker.ts, lines 232-241). The function uses a for...in loop to copy properties from a source object to a target object without: (1) checking hasOwnProperty() to exclude inherited properties, (2) filtering dangerous keys such as __proto__, constructor, and prototype, or (3) validating property sources. An unauthenticated, network-reachable attacker can craft a malicious source object with a poisoned __proto__ property to inject properties into the target object's prototype chain. This bypasses security assumptions in downstream code that relies on hasOwnProperty() checks for validation. The vulnerability affects Maker.js versions 0.19.1 and earlier; a patch was released in version 0.19.2.
Affected products
- Microsoft Maker.js 0.19.1 and earlier
Timeline
- 2026-01-28: disclosed: Vulnerability disclosed on GitHub Security Advisory
- 2026-01-27: patched: Patch released in version 0.19.2
- 2026-01-29: advisory: OSV record published
References
- https://github.com/microsoft/maker.js/security/advisories/GHSA-2cp6-34r9-54xx
- https://github.com/microsoft/maker.js/commit/85e0f12bd868974b891601a141974f929dec36b8
- https://github.com/microsoft/maker.js
- https://github.com/microsoft/maker.js/blob/98cffa82a372ff942194c925a12a311253587167/packages/maker.js/src/core/maker.ts