In the @asymmetric-effort/specifyjs package, several console.warn calls located in core/src/core/scheduler.ts, core/src/hooks/dispatcher.ts, and core/src/client/graphql.ts are not restricted to development builds. As a result, these warnings appear in production builds, potentially exposing internal framework state such as queue sizes, component names, and query fragments. This information disclosure vulnerability is categorized under CWE-209 (Information Exposure Through an Error Message). The vulnerability does not expose sensitive data like credentials or PII but reveals internal architecture details that could be leveraged by an attacker. The affected versions are those before 0.2.140. There is no indication that exploits exist in the wild, and no official patch or remediation has been provided yet.

This vulnerability may disclose internal framework state information to end users through production console warnings. Although it does not expose sensitive information such as credentials or personal data, the leakage of internal details like queue sizes and component names could assist attackers in reconnaissance or crafting targeted attacks. The impact is limited to information exposure without direct compromise or privilege escalation.

No official patch or fix is currently documented. The recommended mitigation is to gate all development-time console.warn and console.error calls behind a check such as process.env.NODE_ENV !== 'production' or a __DEV__ constant that build tools can remove in production builds. This prevents internal state information from being exposed in production environments. Users of affected versions should implement this gating in their builds or monitor for an official fix.