GHSA-qcr8-x557-7cp3Medium▾ Sunlit@asymmetric-effort/specifyjs: Production console warnings may leak internal framework state
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Location: core/src/core/scheduler.ts:23, core/src/hooks/dispatcher.ts:100, core/src/client/graphql.ts:71
Several console.warn calls are not gated behind __DEV__ and will fire in production builds, potentially exposing internal framework state such as queue sizes, component names, and query fragments to users viewing the browser console.
Open — These warnings serve as development-time diagnostics. They do not expose credentials or PII, but may reveal internal architecture details.
Gate all development-time console.warn and console.error calls behind process.env.NODE_ENV !== 'production' or a __DEV__ constant that build tools can tree-shake.
@asymmetric-effort/specifyjs <= 0.2.137Upgrade to a patched release:
@asymmetric-effort/specifyjs 0.2.140Connected by shared product, vendor, weakness, or advisory.
CVE-2026-50288High@asymmetric-effort/specifyjs: URL parse failure silently allows request
GHSA-5c7w-4wm3-85vwMedium@asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection
GHSA-xw57-23p8-9wc5Medium@asymmetric-effort/specifyjs: Localhost bypass incomplete (IPv6, 0.0.0.0, 127.x range)
GHSA-2944-57xv-2682Medium@asymmetric-effort/specifyjs: `data:` URI allowed without size restriction
GHSA-j5qp-p44g-2m49Medium@asymmetric-effort/specifyjs: No redirect target validation in secureFetch
CVE-2026-50290Medium@asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString