CVE-2026-50288
@asymmetric-effort/specifyjs: URL parse failure silently allows request
SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when new URL() throws a parse error, the assertSecureUrl function returned without throwing, silently allowing the request to proceed without HTTPS validation. Starting in version 0.2.136, the catch block now throws an error instead of silently returning.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
@asymmetric-effort/specifyjs: URL parse failure silently allows request
SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when new URL() throws a parse error, the assertSecureUrl function returned without throwing, silently allowing the request to proceed without HTTPS validation. Starting in version 0.2.136, the catch block now throws an error instead of silently returning.
- Record
CVE-2026-50288- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-918
- Updated
- 2026-11-02
EUVDEUVD-2026-64065
SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when new URL() throws a parse error, the assertSecureUrl function returned without throwing, silently allowing the request to proceed without HTTPS validation. Starting in version 0.2.136, the catch block now throws an error instead of silently returning.
- Record
EUVD-2026-64065- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8882-frvv-92w4
@asymmetric-effort/specifyjs: URL parse failure silently allows request
Finding
Location: core/src/shared/secure-fetch.ts:42-45
When new URL() throws a parse error, the assertSecureUrl function returned without throwing, silently allowing the request to proceed without HTTPS validation.
Status
Fixed in v0.2.136 — The catch block now throws an error instead of silently returning.
- Record
GHSA-8882-frvv-92w4- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-918
- Updated
- 2026-11-02
NVD
SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when new URL() throws a parse error, the assertSecureUrl function returned without throwing, silently allowing the request to proceed without HTTPS validation. Starting in version 0.2.136, the catch block now throws an error instead of silently returning.
- Record
CVE-2026-50288- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-918
- Updated
- 2026-11-02
OSV
@asymmetric-effort/specifyjs: URL parse failure silently allows request
SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when new URL() throws a parse error, the assertSecureUrl function returned without throwing, silently allowing the request to proceed without HTTPS validation. Starting in version 0.2.136, the catch block now throws an error instead of silently returning.
- Record
CVE-2026-50288- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSVGHSA-8882-frvv-92w4
@asymmetric-effort/specifyjs: URL parse failure silently allows request
Finding
Location: core/src/shared/secure-fetch.ts:42-45
When new URL() throws a parse error, the assertSecureUrl function returned without throwing, silently allowing the request to proceed without HTTPS validation.
Status
Fixed in v0.2.136 — The catch block now throws an error instead of silently returning.
- Record
GHSA-8882-frvv-92w4- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-918
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
@asymmetric-effort/specifyjsnpm |
before 0.2.136 | 0.2.136 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-50288 is a high vulnerability (CVSS 8.7) in Asymmetric-effort Specifyjs, published July 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. Fixed in @asymmetric-effort/specifyjs 0.2.136.
References
github.com/asymmetric-effort/specifyjs/security/advisories/GHSA-8882-frvv-92w4
nvd.nist.gov/vuln/detail/CVE-2026-50288