GHSA-5c7w-4wm3-85vw: @asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection

July 2, 2026

Finding

Location: core/src/client/graphql.ts:66-80

The gql template tag function warned about interpolated values containing GraphQL metacharacters ({}():) but still concatenated them into the query string, enabling potential GraphQL injection.

Status

Fixed in v0.2.136 — The gql function now throws an error when metacharacters are detected in interpolated values, forcing developers to use the variables parameter.

References

github.com/advisories/GHSA-5c7w-4wm3-85vw
github.com/asymmetric-effort/specifyjs/commit/25d1fb491d99479efdf501f5f75e0bb80c908f0a
github.com/asymmetric-effort/specifyjs/security/advisories/GHSA-5c7w-4wm3-85vw

Code Behaviors & Features

Detect and mitigate GHSA-5c7w-4wm3-85vw with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →