@asymmetric-effort/specifyjs: Production console warnings may leak internal framework state
- Severity:
- Medium
Description
Location: core/src/core/scheduler.ts:23, core/src/hooks/dispatcher.ts:100, core/src/client/graphql.ts:71
Several console.warn calls are not gated behind __DEV__ and will fire in production builds, potentially exposing internal framework state such as queue sizes, component names, and query fragments to users viewing the browser console.
Recommendation
Update the @asymmetric-effort/specifyjs package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.2.137
- Patched version(s): 0.2.140
References
Related Issues
- @asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection - Vulnerability
- @asymmetric-effort/specifyjs: No redirect target validation in secureFetch - Vulnerability
- @asymmetric-effort/specifyjs: `data:` URI allowed without size restriction - Vulnerability
- @asymmetric-effort/specifyjs: Localhost bypass incomplete (IPv6, 0.0.0.0, 127.x range) - Vulnerability
You might also like:
- Tags:
- npm
- @asymmetric-effort/specifyjs
Anything's wrong? Let us know Last updated on July 02, 2026