Security advisories

medium2026-07-02

@asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString

GHSA-93q6-wwjh-jc6h · CVE-2026-50290

medium2026-07-02

@asymmetric-effort/specifyjs: No redirect target validation in secureFetch

GHSA-j5qp-p44g-2m49

medium2026-07-02

@asymmetric-effort/specifyjs: `data:` URI allowed without size restriction

GHSA-2944-57xv-2682

medium2026-07-02

@asymmetric-effort/specifyjs: Localhost bypass incomplete (IPv6, 0.0.0.0, 127.x range)

GHSA-xw57-23p8-9wc5

medium2026-07-02

@asymmetric-effort/specifyjs: Production console warnings may leak internal framework state

GHSA-qcr8-x557-7cp3

medium2026-07-02

@asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection

GHSA-5c7w-4wm3-85vw

high2026-07-02

@asymmetric-effort/specifyjs: URL parse failure silently allows request

GHSA-8882-frvv-92w4 · CVE-2026-50288