TypeScript Framework Vulnerability in SpecifyJS by Asymmetric Effort
CVE-2026-50288

8.7HIGH

Key Information:

Vendor

Asymmetric-effort

Status
Specifyjs
Vendor
CVE Published:
21 August 2026

What is CVE-2026-50288?

SpecifyJS, a TypeScript framework, contained a flaw wherein the assertSecureUrl function failed to throw an error when new URL() encountered a parse error. This issue allowed requests to bypass HTTPS validation, posing a substantial security risk. As of version 0.2.136, the framework addresses this vulnerability by throwing an error in the catch block, ensuring that all requests undergo proper HTTPS validation.

Affected Version(s)

specifyjs < 0.2.136

References

https://github.com/asymmetric-effort/specifyjs/security/a...
x_refsource_CONFIRM
https://github.com/asymmetric-effort/specifyjs/commit/25d...
x_refsource_MISC
https://github.com/asymmetric-effort/specifyjs/releases/t...
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.