Improper Neutralization of Special Elements in Data Query Logic Affecting @asymmetric-effort/specifyjs package, versions <0.2.136
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Improper Neutralization of Special Elements in Data Query Logic vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JS-ASYMMETRICEFFORTSPECIFYJS-17812637
- published4 Jul 2026
- disclosed2 Jul 2026
- creditUnknown
Introduced: 2 Jul 2026
New CVE NOT AVAILABLE CWE-943 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade @asymmetric-effort/specifyjs to version 0.2.136 or higher.
Overview
@asymmetric-effort/specifyjs is an A declarative TypeScript UI framework built for performance and simplicity
Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via the gql function. An attacker can inject unauthorized GraphQL queries or manipulate the intended query structure by supplying interpolated values containing GraphQL metacharacters.