GHSA-xw57-23p8-9wc5 @asymmetric-effort/specifyjs: Localhost bypass incomplete (IPv6, 0.0.0.0, 127.x range)
An incomplete localhost check allows bypassing security restrictions via IPv6 or other loopback addresses, requiring an upgrade to the library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-xw57-23p8-9wc5?
GHSA-xw57-23p8-9wc5 is a vulnerability in @asymmetric-effort/specifyjs, published on 2 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Finding
Location: core/src/shared/secure-fetch.ts:52-54
The localhost exception allowed localhost and 127.0.0.1 but did not cover 0.0.0.0, [::1] (IPv6 localhost), or the full 127.0.0.0/8 loopback range.
Status
Fixed in v0.2.136 — Localhost detection now covers localhost, 127.0.0.1, [::1], 0.0.0.0, and the full 127.x.x.x range.
Which versions are affected by GHSA-xw57-23p8-9wc5?
2 open source packages ship an affected version, including @asymmetric-effort/specifyjs.
| Package | Affected | Fixed in |
|---|---|---|
@asymmetric-effort/specifyjs npm | All versions | 0.2.136 |
@asymmetric-effort/specifyjs npm | All versions | 0.2.136 |
How do I fix GHSA-xw57-23p8-9wc5?
Upgrade @asymmetric-effort/specifyjs to 0.2.136 or later.
Is GHSA-xw57-23p8-9wc5 being exploited?
There is no known exploitation of GHSA-xw57-23p8-9wc5 in the wild and no public exploit code.