PT-2026-57591 · Npm · @Asymmetric-Effort/Specifyjs

Published

2026-07-02

·

Updated

2026-07-02

CVSS v4.0

6.9

Medium

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Finding

Location: core/src/client/graphql.ts:66-80
The gql template tag function warned about interpolated values containing GraphQL metacharacters ({}():) but still concatenated them into the query string, enabling potential GraphQL injection.

Status

Fixed in v0.2.136 — The gql function now throws an error when metacharacters are detected in interpolated values, forcing developers to use the variables parameter.

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-943

Related Identifiers

GHSA-5C7W-4WM3-85VW

Affected Products

@Asymmetric-Effort/Specifyjs