Описание
@asymmetric-effort/specifyjs: Localhost bypass incomplete (IPv6, 0.0.0.0, 127.x range)
Finding
Location: core/src/shared/secure-fetch.ts:52-54
The localhost exception allowed localhost and 127.0.0.1 but did not cover 0.0.0.0, [::1] (IPv6 localhost), or the full 127.0.0.0/8 loopback range.
Status
Fixed in v0.2.136 — Localhost detection now covers localhost, 127.0.0.1, [::1], 0.0.0.0, and the full 127.x.x.x range.
Пакеты
Наименование
@asymmetric-effort/specifyjs
npm
Затронутые версииВерсия исправления
< 0.2.136
0.2.136
6.9 Medium
CVSS4
Дефекты
CWE-918
6.9 Medium
CVSS4
Дефекты
CWE-918