GHSA-2944-57xv-2682: @asymmetric-effort/specifyjs: `data:` URI allowed without size restriction

July 2, 2026

Finding

Location: core/src/shared/secure-fetch.ts:33-35

data: URIs were allowed without any restriction. While data: URIs don’t make network requests, they can be used for memory exhaustion via very large data URIs.

Status

Fixed in v0.2.136 — data: URIs are now limited to 1MB. URIs exceeding this limit throw an error.

References

github.com/advisories/GHSA-2944-57xv-2682
github.com/asymmetric-effort/specifyjs/commit/25d1fb491d99479efdf501f5f75e0bb80c908f0a
github.com/asymmetric-effort/specifyjs/security/advisories/GHSA-2944-57xv-2682

Code Behaviors & Features

Detect and mitigate GHSA-2944-57xv-2682 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →