{"id":"GHSA-8882-frvv-92w4","revision":"b023be469d874de1b0fae2d519457d18","records":[{"revision":"b023be469d874de1b0fae2d519457d18","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-8882-frvv-92w4","aliases":["CVE-2026-50288"],"title":"@asymmetric-effort/specifyjs: URL parse failure silently allows request","description":"## Finding\n\n**Location**: `core/src/shared/secure-fetch.ts:42-45`\n\nWhen `new URL()` throws a parse error, the `assertSecureUrl` function returned without throwing, silently allowing the request to proceed without HTTPS validation.\n\n## Status\n\n**Fixed in v0.2.136** — The catch block now throws an error instead of silently returning.","state":0,"publishedAt":"2026-07-02T18:59:33+00:00","modifiedAt":"2026-09-10T03:50:51.598176+00:00","affected":[{"ecosystem":"npm","name":"@asymmetric-effort/specifyjs","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.2.136"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/asymmetric-effort/specifyjs/security/advisories/GHSA-8882-frvv-92w4","https://github.com/asymmetric-effort/specifyjs/commit/25d1fb491d99479efdf501f5f75e0bb80c908f0a","https://github.com/asymmetric-effort/specifyjs","https://github.com/asymmetric-effort/specifyjs/releases/tag/v0.2.136"],"sourceUrl":"https://github.com/advisories/GHSA-8882-frvv-92w4","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-8882-frvv-92w4","identifiers":["GHSA-8882-frvv-92w4","CVE-2026-50288"]},"retained":false,"historicalAffected":[]}],"coverage":[]}