~ / search / GHSA-8882-frvv-92w4

GHSA-8882-frvv-92w4

@asymmetric-effort/specifyjs: URL parse failure silently allows request

Source: GitHub Advisory Database (reviewed) High CVE-2026-50288

Packages

EcosystemPackageAffectedFixed in
npm @asymmetric-effort/specifyjs < 0.2.136 0.2.136

Details

As written in the advisory (Markdown source, shown as plain text).

## Finding **Location**: `core/src/shared/secure-fetch.ts:42-45` When `new URL()` throws a parse error, the `assertSecureUrl` function returned without throwing, silently allowing the request to proceed without HTTPS validation. ## Status **Fixed in v0.2.136** — The catch block now throws an error instead of silently returning.

References

External links from the advisory. They lead to third-party sites.