CVE-2026-50288

highcovered by 1 sourcefirst seen 2026-07-02

Finding Location: core/src/shared/secure-fetch.ts:42-45 When new URL() throws a parse error, the assertSecureUrl function returned without throwing, silently allowing the request to proceed without HTTPS validation. Status Fixed in v0.2.136 — The catch block now throws an error instead of silently returning.

⚡ Watch CVE-2026-50288

Get an email if CVE-2026-50288 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

highGHSA-8882-frvv-92w4: @asymmetric-effort/specifyjs: URL parse failure silently allows requestghsa · 2026-07-02

External references

NVD record for CVE-2026-50288

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-50288 status](https://www.csirts.com/badge/CVE-2026-50288)](https://www.csirts.com/cve/CVE-2026-50288)