Skip to content
OpenAdvisories

Product · asymmetric-effort

specifyjs

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.7
    CVE-2026-50288

    @asymmetric-effort/specifyjs: URL parse failure silently allows request

    SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when `new URL()` throws a parse error, the `assertSecureUrl` function returned without throwing, silently allowing the request to proceed without HTTPS validation. Start…

    asymmetric-effort specifyjs @asymmetric-effort/specifyjs npm