Maker.js is a 2D vector drawing library developed by Microsoft. In versions up to 0.19.1, its makerjs.extendObject function copies all properties from a source object to a target object without validating ownership or filtering dangerous keys. Because the function does not check hasOwnProperty and allows inherited properties, an attacker could provide a crafted object that injects unwanted properties, including functions, into the target. This behavior exposes consumers of the library to potential security risks, such as code execution or the alteration of application behavior, if the injected properties are later accessed or executed.

Microsoft Maker.js versions 0.19.1 and earlier, running on Node.js environments.

The CVSS score of 6.5 indicates moderate severity, while an EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, meaning no publicly known exploits have been reported to date. The likely attack vector is an application that accepts untrusted input and passes the data to extendObject; if the application runs with elevated privileges, an attacker could exploit the flaw to influence code execution.