{"id":"GHSA-5c7w-4wm3-85vw","aliases":[],"url":"https://o3.security/vulnerability/GHSA-5c7w-4wm3-85vw","summary":"@asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection","details":"## Finding\n\n**Location**: `core/src/client/graphql.ts:66-80`\n\nThe `gql` template tag function warned about interpolated values containing GraphQL metacharacters (`{}():`) but still concatenated them into the query string, enabling potential GraphQL injection.\n\n## Status\n\n**Fixed in v0.2.136** — The `gql` function now throws an error when metacharacters are detected in interpolated values, forcing developers to use the `variables` parameter.","published":"2026-07-02T19:00:12Z","modified":"2026-09-10T03:51:10.446887808Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@asymmetric-effort/specifyjs","fixedVersion":"0.2.136"}],"fix":{"url":"https://github.com/asymmetric-effort/specifyjs/commit/25d1fb491d99479efdf501f5f75e0bb80c908f0a","label":"asymmetric-effort/specifyjs@25d1fb4"},"references":[{"type":"WEB","url":"https://github.com/asymmetric-effort/specifyjs/security/advisories/GHSA-5c7w-4wm3-85vw"},{"type":"WEB","url":"https://github.com/asymmetric-effort/specifyjs/commit/25d1fb491d99479efdf501f5f75e0bb80c908f0a"},{"type":"PACKAGE","url":"https://github.com/asymmetric-effort/specifyjs"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-10T03:51:10.446887808Z"}}