Skip to content
Threat Feed
Subscribe

Product

@Asymmetric-Effort/Specifyjs (< 0.2.136)

1 brief RSS
high advisory

@asymmetric-effort/specifyjs: URL Parse Failure Silently Allows Request (CVE-2026-50288)

A high-severity vulnerability, CVE-2026-50288, in the `@asymmetric-effort/specifyjs` npm package (versions prior to 0.2.136) allows for the silent bypass of HTTPS validation by mishandling URL parse errors in the `assertSecureUrl` function, which can lead to Server-Side Request Forgery (SSRF).

@asymmetric-effort/specifyjs npm supply-chain vulnerability ssrf javascript
1t