Description
The makerjs.extendObject function copies properties from source objects without proper validation, potentially exposing applications to security risks. The function lacks hasOwnProperty() checks and does not filter dangerous keys, allowing inherited properties and potentially malicious properties to be copied to target objects.
Recommendation
Update the makerjs package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.19.1
- Patched version(s): 0.19.2
References
Could your website be exposed too?
SmartScanner can check your website for Maker.js has Unsafe Property Copying in makerjs.extendObject and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging - CVE-2026-54737
- Unsafe object property setter in mathjs - CVE-2026-40897
- Electerm: Importing unsafe bookmark data could lead to unsafe operation when clicking local type bookmark - CVE-2026-45058
- Orval has a code injection via unsanitized x-enum-descriptions in enum generation - CVE-2026-23947
You might also like:
See something that needs correcting? Let us knowUpdated January 29, 2026