SpecifyJS incorrectly handled URL parsing errors. When new URL() throws, the assertSecureUrl function returns silently, allowing transport to proceed without enforcing HTTPS. This omission enables attackers to redirect traffic to insecure endpoints or intercept data, effectively bypassing confidentiality safeguards. The flaw is categorized as CWE-918.

SpecifyJS versions earlier than 0.2.136 are affected. The vulnerability exists in all deployments using asymmetric-effort/specifyjs before that release. Users on version 0.2.135 or earlier must update to 0.2.136 or later to fix the issue.

With a CVSS score of 8.7 the vulnerability poses a high risk. Even though a current EPSS score is unavailable, the lack of an EPSS entry does not mitigate potential for exploitation. The vulnerability is not listed in the CISA KEV catalog, but the ability to silently bypass HTTPS validation can be leveraged in both client and server contexts where SpecifyJS processes user‑provided URLs. Attackers would need to craft a request that triggers a URL parsing exception; no additional credentials or privileges are required.