mediumVulnerability
GHSA-xw57-23p8-9wc5
## Finding **Location**: `core/src/shared/secure-fetch.ts:52-54` The localhost exception allowed `localhost` and `127.0.0.1` but did not cover `0.0.0.0`, `[::1]` (IPv6 localhost), or the full `127.0.0.0/8` loopback range. ## Status **Fixed in v0.2.136** — Localhost detection now covers `localhost`, `127.0.0.1`, `[::1]`, `0.0.0.0`, and the full `127.x.x.x` range.
Properties
- ghsa_id
- GHSA-xw57-23p8-9wc5
- severity
- medium
- summary
- @asymmetric-effort/specifyjs: Localhost bypass incomplete (IPv6, 0.0.0.0, 127.x range)
- cve_id
- GHSA-xw57-23p8-9wc5
- is_ghsa_only
- true
- ghsa_published
- 2026-07-02T19:07:22Z
- source_url
- https://github.com/advisories/GHSA-xw57-23p8-9wc5
- ghsa_updated
- 2026-07-02T19:07:24Z
Related Entities (4)
AFFECTS (1)
→[Software]npm/@asymmetric-effort/specifyjs
HAS_WEAKNESS (1)
→[Weakness]Server-Side Request Forgery (SSRF)
REPORTED_BY (1)
→[Source]GitHub Advisory Database
VULNERABLE_TO (1)
←[Software]npm/@asymmetric-effort/specifyjs
Explore deeper with Ninja Signal's threat intelligence graph