Executive brief
@asymmetric-effort/specifyjs is a TypeScript UI framework that includes a GraphQL query helper function (gql tag). The gql tag allowed malicious GraphQL syntax characters to be injected into queries through string interpolation, enabling attackers to modify query logic. This could lead to unauthorized data access or manipulation if the application fails to validate user input before passing it to the gql tag.
Technical details
The vulnerability is an improper neutralization of special elements in GraphQL query construction (CWE-943). The gql template tag function in core/src/client/graphql.ts (lines 66–80) warned but did not prevent interpolated values containing GraphQL metacharacters ({, }, (, ), :, whitespace) from being concatenated directly into the query string. This allowed GraphQL injection attacks where unsanitized user input could alter query structure and intent. The fix in version 0.2.136 changes the behavior from warning to throwing an error when metacharacters are detected, forcing developers to use GraphQL variables for dynamic values instead of string interpolation. No authentication or special preconditions are required; exploitation depends on whether developers pass untrusted input to the gql tag.
Affected products
- @asymmetric-effort specifyjs < 0.2.136
Timeline
- 2026-07-02: disclosed: GHSA-5c7w-4wm3-85vw published
- 2026-05-29: patched: Fixed in v0.2.136