GHSA-j5qp-p44g-2m49 @asymmetric-effort/specifyjs: No redirect target validation in secureFetch
Attackers can exploit unvalidated redirects in secureFetch to access internal services, bypassing URL validation controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-j5qp-p44g-2m49?
GHSA-j5qp-p44g-2m49 is a server-side request forgery vulnerability in @asymmetric-effort/specifyjs, published on 2 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Finding
Location: core/src/shared/secure-fetch.ts
assertSecureUrl validated only the initial request URL. The fetch() API follows redirects by default (up to 20 hops). A request to a valid https:// URL could redirect to http://internal-service/ or other unvalidated destinations.
Status
Fixed in v0.2.136 — secureFetch now defaults to redirect: 'error' which rejects any redirect. Callers can override with { redirect: 'follow' } if they trust the target.
Which versions are affected by GHSA-j5qp-p44g-2m49?
2 open source packages ship an affected version, including @asymmetric-effort/specifyjs.
| Package | Affected | Fixed in |
|---|---|---|
@asymmetric-effort/specifyjs npm | All versions | 0.2.136 |
@asymmetric-effort/specifyjs npm | All versions | 0.2.136 |
How do I fix GHSA-j5qp-p44g-2m49?
Upgrade @asymmetric-effort/specifyjs to 0.2.136 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is GHSA-j5qp-p44g-2m49 being exploited?
There is no known exploitation of GHSA-j5qp-p44g-2m49 in the wild and no public exploit code.