CVE-2026-50288: SpecifyJS SSRF via URL validation bypass in secure-fetch

CVE-2026-50288 · Severity: high · CVSS 4 · Published 2026-08-21

A vulnerability in the SpecifyJS library could allow network requests to bypass security checks. The library is designed to enforce secure HTTPS connections, but certain malformed web addresses could cause the validation process to fail silently, allowing potentially insecure or unauthorized requests to proceed. This could lead to unauthorized data access or internal network requests.

Technologies: Asymmetric Effort Specifyjs, @asymmetric-effort/specifyjs (npm). Vendors: Asymmetric Effort, npm.

Quick answers

Is CVE-2026-50288 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50288 being exploited in the wild.
How severe is CVE-2026-50288?
High severity, with a CVSS score of 4, published 21 August 2026.
Which products and versions are affected?
Asymmetric Effort Specifyjs < 0.2.136; @asymmetric-effort/specifyjs (npm) < 0.2.136, SEMVER:introduced=0,fixed=0.2.136.
Is there a fix for CVE-2026-50288?
Yes. @asymmetric-effort/specifyjs (npm): upgrade to 0.2.136 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50288 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-50288?
Check whether you run Asymmetric Effort Specifyjs or @asymmetric-effort/specifyjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @asymmetric-effort/specifyjs (npm): upgrade to 0.2.136 or later
    npm install @asymmetric-effort/specifyjs@0.2.136

Technical details

A vulnerability exists in the `assertSecureUrl` function within `core/src/shared/secure-fetch.ts`. When the `new URL()` constructor throws a parse error, the function's catch block returns silently instead of throwing an exception. This behavior allows the request to proceed without completing the intended HTTPS and security validation checks. An attacker can exploit this by providing malformed URLs that trigger a parsing error but are still processed by the underlying fetch mechanism, potentially leading to Server-Side Request Forgery (SSRF). The issue is fixed in version 0.2.136 by ensuring the catch block properly throws an error.

Affected products

  • asymmetric-effort @asymmetric-effort/specifyjs < 0.2.136

Identifiers

  • CVE-2026-50288
  • GHSA-8882-frvv-92w4

Timeline

  • 2026-05-29: patched: Fix included in version 0.2.136
  • 2026-07-02: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.