CVE-2026-50288

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-50288", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-04T16:26:05.985Z", "datePublished": "2026-08-21T19:29:45.774Z", "dateUpdated": "2026-08-21T19:55:40.103Z"}, "containers": {"cna": {"title": "@asymmetric-effort/specifyjs: URL parse failure silently allows request", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/asymmetric-effort/specifyjs/security/advisories/GHSA-8882-frvv-92w4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/asymmetric-effort/specifyjs/security/advisories/GHSA-8882-frvv-92w4"}, {"name": "https://github.com/asymmetric-effort/specifyjs/commit/25d1fb491d99479efdf501f5f75e0bb80c908f0a", "tags": ["x_refsource_MISC"], "url": "https://github.com/asymmetric-effort/specifyjs/commit/25d1fb491d99479efdf501f5f75e0bb80c908f0a"}, {"name": "https://github.com/asymmetric-effort/specifyjs/releases/tag/v0.2.136", "tags": ["x_refsource_MISC"], "url": "https://github.com/asymmetric-effort/specifyjs/releases/tag/v0.2.136"}], "affected": [{"vendor": "asymmetric-effort", "product": "specifyjs", "versions": [{"version": "< 0.2.136", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-21T19:29:45.774Z"}, "descriptions": [{"lang": "en", "value": "SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when `new URL()` throws a parse error, the `assertSecureUrl` function returned without throwing, silently allowing the request to proceed without HTTPS validation. Starting in version 0.2.136, the catch block now throws an error instead of silently returning."}], "source": {"advisory": "GHSA-8882-frvv-92w4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-21T19:55:29.805504Z", "id": "CVE-2026-50288", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T19:55:40.103Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-50288", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T19:55:29.805504Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T19:55:35.061Z"}}], "cna": {"title": "@asymmetric-effort/specifyjs: URL parse failure silently allows request", "source": {"advisory": "GHSA-8882-frvv-92w4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "asymmetric-effort", "product": "specifyjs", "versions": [{"status": "affected", "version": "< 0.2.136"}]}], "references": [{"url": "https://github.com/asymmetric-effort/specifyjs/security/advisories/GHSA-8882-frvv-92w4", "name": "https://github.com/asymmetric-effort/specifyjs/security/advisories/GHSA-8882-frvv-92w4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/asymmetric-effort/specifyjs/commit/25d1fb491d99479efdf501f5f75e0bb80c908f0a", "name": "https://github.com/asymmetric-effort/specifyjs/commit/25d1fb491d99479efdf501f5f75e0bb80c908f0a", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asymmetric-effort/specifyjs/releases/tag/v0.2.136", "name": "https://github.com/asymmetric-effort/specifyjs/releases/tag/v0.2.136", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when `new URL()` throws a parse error, the `assertSecureUrl` function returned without throwing, silently allowing the request to proceed without HTTPS validation. Starting in version 0.2.136, the catch block now throws an error instead of silently returning."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-21T19:29:45.774Z"}}}, "cveMetadata": {"cveId": "CVE-2026-50288", "state": "PUBLISHED", "dateUpdated": "2026-08-21T19:55:40.103Z", "dateReserved": "2026-06-04T16:26:05.985Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-21T19:29:45.774Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "specifyjs", "vendor": "asymmetric-effort", "versions": [{"status": "affected", "version": "< 0.2.136"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when `new URL()` throws a parse error, the `assertSecureUrl` function returned without throwing, silently allowing the request to proceed without HTTPS validation. Starting in version 0.2.136, the catch block now throws an error instead of silently returning."}, {"lang": "es", "value": "SpecifyJS es un framework de interfaz de usuario declarativo de TypeScript. Antes de la versi\u00f3n 0.2.136, cuando 'new URL()' lanzaba un error de an\u00e1lisis, la funci\u00f3n 'assertSecureUrl' devolv\u00eda sin lanzar, permitiendo silenciosamente que la solicitud procediera sin validaci\u00f3n HTTPS. A partir de la versi\u00f3n 0.2.136, el bloque catch ahora lanza un error en lugar de devolver silenciosamente."}], "id": "CVE-2026-50288", "lastModified": "2026-10-14T19:10:00.297", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50288", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T19:55:29.805504Z", "version": "2.0.3"}}]}, "published": "2026-08-21T20:16:36.067", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/asymmetric-effort/specifyjs/commit/25d1fb491d99479efdf501f5f75e0bb80c908f0a"}, {"source": "security-advisories@github.com", "url": "https://github.com/asymmetric-effort/specifyjs/releases/tag/v0.2.136"}, {"source": "security-advisories@github.com", "url": "https://github.com/asymmetric-effort/specifyjs/security/advisories/GHSA-8882-frvv-92w4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.2.136)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "specifyjs", "source": "cna", "vendor": "asymmetric-effort"}, "product": "specifyjs", "vendor": "asymmetric-effort"}], "created": "2026-08-21T20:30:07.389478+00:00", "updated": "2026-08-21T21:14:45.305257+00:00", "vendors": ["asymmetric-effort", "asymmetric-effort$PRODUCT$specifyjs"]}