Read the docs
TI-2026-67010 Aliases GHSA-qcr8-x557-7cp3

@asymmetric-effort/specifyjs: Production console warnings may leak internal framework state

Priority LOW 38CWE-209Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Information disclosure
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-209.

Summary

## Finding **Location**: `core/src/core/scheduler.ts:23`, `core/src/hooks/dispatcher.ts:100`, `core/src/client/graphql.ts:71` Several `console.warn` calls are not gated behind `__DEV__` and will fire in production builds, potentially exposing internal framework state such as queue sizes, component names, and query fragments to users viewing the browser console. ## Status **Open** — These warnings serve as development-time diagnostics. They do not expose credentials or PII, but may reveal internal architecture details. ## Recommendation Gate all development-time `console.warn` and `console.error` calls behind `process.env.NODE_ENV !== 'production'` or a `__DEV__` constant that build tools can tree-shake.

Why it matters now

Fix Fixed @asymmetric-effort/specifyjs (npm): 0.2.140

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—@asymmetric-effort/specifyjs (npm)before 0.2.1400.2.140Patch availableGHSA-qcr8-x557-7cp3
  • @asymmetric-effort/specifyjs (npm) Vendor— Affected before 0.2.140 Fixed in 0.2.140 Patch available GHSA-qcr8-x557-7cp3

Remediation

  • Fix · GHSA-qcr8-x557-7cp3 @asymmetric-effort/specifyjs (npm) Fixed in 0.2.140 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-qcr8-x557-7cp3

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences