CyberRota Analysis
AI-GeneratedSpecifyJS versions prior to 0.2.136 are vulnerable due to a flaw in the `assertSecureUrl` function, which fails to properly validate HTTPS URLs when a `new URL()` parse error occurs, potentially allowing insecure requests to proceed. This oversight could lead to security risks such as man-in-the-middle attacks. Developers and organizations using SpecifyJS should prioritize upgrading to version 0.2.136 or later to mitigate this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when `new URL()` throws a parse error, the `assertSecureUrl` function returned without throwing, silently allowing the request to proceed without HTTPS validation. Starting in version 0.2.136, the catch block now throws an error instead of silently returning.