CVE-2026-50288CWE-918ssrf

CVE-2026-50288

published August 22, 2026

CVSS
8.7
EPSS
0%
Percentile
40.4
In the wild
Unconfirmed
What it is

SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when `new URL()` throws a parse error, the `assertSecureUrl` function returned without throwing, silently allowing the request to proceed without HTTPS validation. Starting in version 0.2.136, the catch block now throws an error instead of silently returning.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00480 · 40.4th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-08-22T00:16Z
References (3)
https://github.com/asymmetric-effort/specifyjs/commit/25d1fb491d99479efdf501f5f75e0bb80c908f0a · [email protected]https://github.com/asymmetric-effort/specifyjs/releases/tag/v0.2.136 · [email protected]https://github.com/asymmetric-effort/specifyjs/security/advisories/GHSA-8882-frvv-92w4 · [email protected]
EPSS history
Timeline
  • 21 AUG 19:29Z
    @asymmetric-effort/specifyjs: URL parse failure silently allows request
    cvelistv5