GHSA-qcr8-x557-7cp3 @asymmetric-effort/specifyjs: Production console warnings may leak internal framework state
Production console warnings in specifyjs leak internal framework state like queue sizes and component names to users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-qcr8-x557-7cp3?
GHSA-qcr8-x557-7cp3 is a vulnerability in @asymmetric-effort/specifyjs, published on 2 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Finding
Location: core/src/core/scheduler.ts:23, core/src/hooks/dispatcher.ts:100, core/src/client/graphql.ts:71
Several console.warn calls are not gated behind __DEV__ and will fire in production builds, potentially exposing internal framework state such as queue sizes, component names, and query fragments to users viewing the browser console.
Status
Open — These warnings serve as development-time diagnostics. They do not expose credentials or PII, but may reveal internal architecture details.
Recommendation
Gate all development-time console.warn and console.error calls behind process.env.NODE_ENV !== 'production' or a __DEV__ constant that build tools can tree-shake.
Which versions are affected by GHSA-qcr8-x557-7cp3?
2 open source packages ship an affected version, including @asymmetric-effort/specifyjs.
| Package | Affected | Fixed in |
|---|---|---|
@asymmetric-effort/specifyjs npm | All versions | 0.2.140 |
@asymmetric-effort/specifyjs npm | All versions | 0.2.140 |
How do I fix GHSA-qcr8-x557-7cp3?
Upgrade @asymmetric-effort/specifyjs to 0.2.140 or later.
Is GHSA-qcr8-x557-7cp3 being exploited?
There is no known exploitation of GHSA-qcr8-x557-7cp3 in the wild and no public exploit code.