Information Exposure Affecting @asymmetric-effort/specifyjs package, versions <0.2.140
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Information Exposure vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JS-ASYMMETRICEFFORTSPECIFYJS-17812641
- published4 Jul 2026
- disclosed2 Jul 2026
- creditUnknown
Introduced: 2 Jul 2026
New CVE NOT AVAILABLE CWE-209 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade @asymmetric-effort/specifyjs to version 0.2.140 or higher.
Overview
@asymmetric-effort/specifyjs is an A declarative TypeScript UI framework built for performance and simplicity
Affected versions of this package are vulnerable to Information Exposure in the console.warn process. An attacker can gain insight into internal framework state, such as queue sizes, component names, and query fragments, by viewing messages in the browser console during production use.