@asymmetric-effort/specifyjs 0.2.74

Direct Vulnerabilities

Known vulnerabilities in the @asymmetric-effort/specifyjs package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Server-side Request Forgery (SSRF) @asymmetric-effort/specifyjs is an A declarative TypeScript UI framework built for performance and simplicity Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the `secureFetch` process. An attacker can access internal or unintended network resources by supplying a crafted URL that causes a redirect to an unvalidated destination. How to fix Server-side Request Forgery (SSRF)? Upgrade `@asymmetric-effort/specifyjs` to version 0.2.136 or higher.	<0.2.136
M Server-side Request Forgery (SSRF) @asymmetric-effort/specifyjs is an A declarative TypeScript UI framework built for performance and simplicity Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through the `secure-fetch` process. An attacker can cause memory exhaustion by supplying a very large `data:` URI. How to fix Server-side Request Forgery (SSRF)? Upgrade `@asymmetric-effort/specifyjs` to version 0.2.136 or higher.	<0.2.136
M Cross-site Scripting (XSS) @asymmetric-effort/specifyjs is an A declarative TypeScript UI framework built for performance and simplicity Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the `renderToString` process. An attacker can inject malicious CSS expressions by bypassing the sanitization mechanism using unicode escapes, null bytes, or CSS comments. This may result in unintended script execution in legacy browsers (IE6-IE10). This is only exploitable if the application is accessed using legacy browsers that support these CSS injection vectors. How to fix Cross-site Scripting (XSS)? Upgrade `@asymmetric-effort/specifyjs` to version 0.2.136 or higher.	<0.2.136
M Information Exposure @asymmetric-effort/specifyjs is an A declarative TypeScript UI framework built for performance and simplicity Affected versions of this package are vulnerable to Information Exposure in the `console.warn` process. An attacker can gain insight into internal framework state, such as queue sizes, component names, and query fragments, by viewing messages in the browser console during production use. How to fix Information Exposure? Upgrade `@asymmetric-effort/specifyjs` to version 0.2.140 or higher.	<0.2.140
M Server-side Request Forgery (SSRF) @asymmetric-effort/specifyjs is an A declarative TypeScript UI framework built for performance and simplicity Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) due to incomplete validation in the `secure-fetch` process. An attacker can access internal network resources by sending requests to loopback addresses that were not properly restricted. How to fix Server-side Request Forgery (SSRF)? Upgrade `@asymmetric-effort/specifyjs` to version 0.2.136 or higher.	<0.2.136
M Improper Neutralization of Special Elements in Data Query Logic @asymmetric-effort/specifyjs is an A declarative TypeScript UI framework built for performance and simplicity Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via the `gql` function. An attacker can inject unauthorized GraphQL queries or manipulate the intended query structure by supplying interpolated values containing GraphQL metacharacters. How to fix Improper Neutralization of Special Elements in Data Query Logic? Upgrade `@asymmetric-effort/specifyjs` to version 0.2.136 or higher.	<0.2.136
H Server-side Request Forgery (SSRF) @asymmetric-effort/specifyjs is an A declarative TypeScript UI framework built for performance and simplicity Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the `assertSecureUrl` function. An attacker can bypass HTTPS validation by supplying a malformed URL that triggers a parse error, causing the function to return without enforcing security checks. How to fix Server-side Request Forgery (SSRF)? Upgrade `@asymmetric-effort/specifyjs` to version 0.2.136 or higher.	<0.2.136

Vulnerability

Vulnerable Version

Server-side Request Forgery (SSRF)