The vulnerability in @asymmetric-effort/specifyjs (prior to v0.2.136) involves the secureFetch function's lack of validation for redirect targets. While the initial request URL was validated by assertSecureUrl, the fetch API's default behavior to follow redirects (up to 20 hops) was not restricted. This allowed a request to a validated HTTPS URL to be redirected to an unvalidated and potentially insecure HTTP URL, such as an internal service. The fix implemented in v0.2.136 sets secureFetch to default to redirect: 'error', which rejects redirects unless the caller explicitly opts in to follow them.

An attacker could exploit this vulnerability by causing a request to a trusted HTTPS endpoint to be redirected to an untrusted or internal HTTP endpoint without validation. This could lead to unintended data exposure or interaction with internal services that were not meant to be accessed externally. The vulnerability is rated as medium severity and does not require privileges or user interaction to exploit.

This vulnerability is fixed in @asymmetric-effort/specifyjs version 0.2.136 and later. Users should upgrade to v0.2.136 or above to ensure secureFetch rejects redirects by default. If redirects are necessary, callers must explicitly specify { redirect: 'follow' } and ensure they trust the redirect targets. No additional mitigation is required beyond upgrading or carefully managing redirect options.