@asymmetric-effort/specifyjs: Production console warnings may leak internal framework state

published 2026-07-02 4mo ago modified 2026-09-10 2mo ago

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

## Finding

**Location**: `core/src/core/scheduler.ts:23`, `core/src/hooks/dispatcher.ts:100`, `core/src/client/graphql.ts:71`

Several `console.warn` calls are not gated behind `__DEV__` and will fire in production builds, potentially exposing internal framework state such as queue sizes, component names, and query fragments to users viewing the browser console.

## Status

**Open** — These warnings serve as development-time diagnostics. They do not expose credentials or PII, but may reveal internal architecture details.

## Recommendation

Gate all development-time `console.warn` and `console.error` calls behind `process.env.NODE_ENV !== 'production'` or a `__DEV__` constant that build tools can tree-shake.

Patch / fix

fixed in 1 links 1

npm @asymmetric-effort/specifyjs 0.2.140

github.com/asymmetric-effort/specifyjs@2ef791b commit

Is GHSA-qcr8-x557-7cp3 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
npm	@asymmetric-effort/specifyjs	<0.2.140	0.2.140

Classification

Weakness

CWE-209 Generation of Error Message Containing Sensitive Information

References

Sources

GitHub Advisory GHSA-qcr8-x557-7cp3

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.