Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 4, published 2 July 2026.

Which products and versions are affected?

Asymmetric Effort Specifyjs < 0.2.136; @asymmetric-effort/specifyjs (npm) SEMVER:introduced=0,fixed=0.2.136.

Is there a fix for This vulnerability?

Yes. @asymmetric-effort/specifyjs (npm): upgrade to 0.2.136 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Asymmetric Effort Specifyjs or @asymmetric-effort/specifyjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

@asymmetric-effort/specifyjs GraphQL injection in gql tag

Q: Is there a fix for This vulnerability?

Yes. @asymmetric-effort/specifyjs (npm): upgrade to 0.2.136 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run Asymmetric Effort Specifyjs or @asymmetric-effort/specifyjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: medium · CVSS 4 · Published 2026-07-02

@asymmetric-effort/specifyjs is a TypeScript UI framework that includes a GraphQL query helper function (gql tag). The gql tag allowed malicious GraphQL syntax characters to be injected into queries through string interpolation, enabling attackers to modify query logic. This could lead to unauthorized data access or manipulation if the application fails to validate user input before passing it to the gql tag.

Technologies: Asymmetric Effort Specifyjs, @asymmetric-effort/specifyjs (npm). Vendors: Asymmetric Effort, npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 4, published 2 July 2026.
Which products and versions are affected?: Asymmetric Effort Specifyjs < 0.2.136; @asymmetric-effort/specifyjs (npm) SEMVER:introduced=0,fixed=0.2.136.
Is there a fix for This vulnerability?: Yes. @asymmetric-effort/specifyjs (npm): upgrade to 0.2.136 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Asymmetric Effort Specifyjs or @asymmetric-effort/specifyjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@asymmetric-effort/specifyjs (npm): upgrade to 0.2.136 or later
```
npm install @asymmetric-effort/specifyjs@0.2.136
```

Technical details

The vulnerability is an improper neutralization of special elements in GraphQL query construction (CWE-943). The gql template tag function in core/src/client/graphql.ts (lines 66–80) warned but did not prevent interpolated values containing GraphQL metacharacters ({, }, (, ), :, whitespace) from being concatenated directly into the query string. This allowed GraphQL injection attacks where unsanitized user input could alter query structure and intent. The fix in version 0.2.136 changes the behavior from warning to throwing an error when metacharacters are detected, forcing developers to use GraphQL variables for dynamic values instead of string interpolation. No authentication or special preconditions are required; exploitation depends on whether developers pass untrusted input to the gql tag.

Affected products

@asymmetric-effort specifyjs < 0.2.136

Timeline

2026-07-02: disclosed: GHSA-5c7w-4wm3-85vw published
2026-05-29: patched: Fixed in v0.2.136

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.