CVE-2026-50288
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when `new URL()` throws a parse error, the `assertSecureUrl` function returned without throwing, silently allowing the request to proceed without HTTPS validation. Starting in version 0.2.136, the catch block now throws an error instead of silently returning.
Risk Assessment
This vulnerability may allow requests to be sent to insecure URLs, potentially exposing data to interception or modification by an attacker.
Recommendation
It is recommended to upgrade SpecifyJS to version 0.2.136 or later to ensure proper HTTPS validation.
Other vulnerabilities in SpecifyJS
Original NVD description (English source)
SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when `new URL()` throws a parse error, the `assertSecureUrl` function returned without throwing, silently allowing the request to proceed without HTTPS validation. Starting in version 0.2.136, the catch block now throws an error instead of silently returning.