Vulnerability Description
SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when `new URL()` throws a parse error, the `assertSecureUrl` function returned without throwing, silently allowing the request to proceed without HTTPS validation. Starting in version 0.2.136, the catch block now throws an error instead of silently returning.
Related Weaknesses (CWE)
References
- https://github.com/asymmetric-effort/specifyjs/commit/25d1fb491d99479efdf501f5f7
- https://github.com/asymmetric-effort/specifyjs/releases/tag/v0.2.136
- https://github.com/asymmetric-effort/specifyjs/security/advisories/GHSA-8882-frv
FAQ
What is CVE-2026-50288?
CVE-2026-50288 is a documented vulnerability. SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when `new URL()` throws a parse error, the `assertSecureUrl` function returned without throwing, silently allo...
How severe is CVE-2026-50288?
CVSS scoring is not yet available for CVE-2026-50288. Check NVD for updates.
Is there a patch for CVE-2026-50288?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.