Executive brief
SpecifyJS is a JavaScript library used for building web applications. A vulnerability in its GraphQL query builder allowed attackers to inject malicious commands into database queries. This could allow an attacker to manipulate data or bypass intended query logic. The issue has been fixed in version 0.2.136.
Technical details
A GraphQL injection vulnerability exists in the `gql` template tag function within `core/src/client/graphql.ts`. The function previously identified GraphQL metacharacters (such as `{}():`) in interpolated values and issued a warning, but proceeded to concatenate them directly into the final query string. This improper neutralization of special elements (CWE-943) allows an attacker to alter the structure of GraphQL queries. The vulnerability is exploitable over the network without authentication if user-controlled input is passed to the template tag. The fix in version 0.2.136 changes this behavior to throw a runtime error when metacharacters are detected, forcing the use of parameterized variables.
Affected products
- asymmetric-effort specifyjs < 0.2.136
Timeline
- 2026-05-29: patched: Fixed in version 0.2.136
- 2026-07-02: advisory: GitHub Advisory published