Description
Location: core/src/client/graphql.ts:66-80
The gql template tag function warned about interpolated values containing GraphQL metacharacters ({}():) but still concatenated them into the query string, enabling potential GraphQL injection.
Recommendation
Update the @asymmetric-effort/specifyjs package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.2.136
- Patched version(s): 0.2.136
References
Could your website be exposed too?
SmartScanner can check your website for @asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @asymmetric-effort/specifyjs: No redirect target validation in secureFetch - Vulnerability
- @asymmetric-effort/specifyjs: `data:` URI allowed without size restriction - Vulnerability
- @asymmetric-effort/specifyjs: Localhost bypass incomplete (IPv6, 0.0.0.0, 127.x range) - Vulnerability
- @asymmetric-effort/specifyjs: Production console warnings may leak internal framework state - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated July 02, 2026