Description
Location: core/src/shared/secure-fetch.ts:42-45
When new URL() throws a parse error, the assertSecureUrl function returned without throwing, silently allowing the request to proceed without HTTPS validation.
Recommendation
Update the @asymmetric-effort/specifyjs package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.2.136
- Patched version(s): 0.2.136
References
Could your website be exposed too?
SmartScanner can check your website for @asymmetric-effort/specifyjs: URL parse failure silently allows request and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString - CVE-2026-50290
- @asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection - Vulnerability
- Server-Side Request Forgery in parse-url - CVE-2022-2216
- @asymmetric-effort/specifyjs: Production console warnings may leak internal framework state - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated July 02, 2026