CVE-2026-50288

SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when `new URL()` throws a parse error, the `assertSecureUrl` function returned without throwing, silently allowing the request to proceed without HTTPS validation. Starting in version 0.2.136, the catch block now throws an error instead of silently returning.

CVSS

No CVSS.

References

Link	Resource
https://github.com/asymmetric-effort/specifyjs/commit/25d1fb491d99479efdf501f5f75e0bb80c908f0a
https://github.com/asymmetric-effort/specifyjs/releases/tag/v0.2.136
https://github.com/asymmetric-effort/specifyjs/security/advisories/GHSA-8882-frvv-92w4

Configurations

No configuration.

History

14 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) SpecifyJS es un framework de interfaz de usuario declarativo de TypeScript. Antes de la versión 0.2.136, cuando 'new URL()' lanzaba un error de análisis, la función 'assertSecureUrl' devolvía sin lanzar, permitiendo silenciosamente que la solicitud procediera sin validación HTTPS. A partir de la versión 0.2.136, el bloque catch ahora lanza un error en lugar de devolver silenciosamente.

Information

Published : 2026-08-21 20:16

Updated : 2026-10-14 19:10

NVD link : CVE-2026-50288

Mitre link : CVE-2026-50288

CVE.ORG link : CVE-2026-50288

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-50288", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50288", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T19:55:29.805504Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "asymmetric-effort", "product": "specifyjs", "versions": [{"status": "affected", "version": "< 0.2.136"}]}]}], "published": "2026-08-21T20:16:36.067", "references": [{"url": "https://github.com/asymmetric-effort/specifyjs/commit/25d1fb491d99479efdf501f5f75e0bb80c908f0a", "source": "security-advisories@github.com"}, {"url": "https://github.com/asymmetric-effort/specifyjs/releases/tag/v0.2.136", "source": "security-advisories@github.com"}, {"url": "https://github.com/asymmetric-effort/specifyjs/security/advisories/GHSA-8882-frvv-92w4", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when `new URL()` throws a parse error, the `assertSecureUrl` function returned without throwing, silently allowing the request to proceed without HTTPS validation. Starting in version 0.2.136, the catch block now throws an error instead of silently returning."}, {"lang": "es", "value": "SpecifyJS es un framework de interfaz de usuario declarativo de TypeScript. Antes de la versi\u00f3n 0.2.136, cuando 'new URL()' lanzaba un error de an\u00e1lisis, la funci\u00f3n 'assertSecureUrl' devolv\u00eda sin lanzar, permitiendo silenciosamente que la solicitud procediera sin validaci\u00f3n HTTPS. A partir de la versi\u00f3n 0.2.136, el bloque catch ahora lanza un error en lugar de devolver silenciosamente."}], "lastModified": "2026-10-14T19:10:00.297", "sourceIdentifier": "security-advisories@github.com"}