GitHub Advisoryadvisory · npm

GHSA-5c7w-4wm3-85vw @asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection

MEDIUM Published 2026-07-02 Modified 2026-07-02 Official page ↗
Ecosystem
npm
Packages
@asymmetric-effort/specifyjs
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-943
Reviewed
2026-07-02

Affected packages

• npm @asymmetric-effort/specifyjs: < 0.2.136 → fixed in 0.2.136

Description

Finding Location: `core/src/client/graphql.ts:66-80` The `gql` template tag function warned about interpolated values containing GraphQL metacharacters (`{}():`) but still concatenated them into the query string, enabling potential GraphQL injection. Status Fixed in v0.2.136 — The `gql` function now throws an error when metacharacters are detected in interpolated values, forcing developers to use the `variables` parameter.

Related

Weakness · CWE (1)

  • CWE-943 Improper Neutralization of Special Elements in Data Query Logic weakness

References