The vulnerability in @asymmetric-effort/specifyjs versions before 0.2.136 involves an incomplete localhost bypass in the secure-fetch module. Specifically, the code only recognized 'localhost' and '127.0.0.1' as localhost addresses, omitting '0.0.0.0', the IPv6 localhost '[::1]', and the full 127.0.0.0/8 loopback range. This incomplete detection could allow requests from these unrecognized localhost addresses to bypass intended localhost-only restrictions. The issue was fixed in version 0.2.136 by expanding the localhost detection to cover all these addresses.

The impact is moderate as the incomplete localhost detection could allow requests from certain localhost IP addresses (0.0.0.0, IPv6 localhost, and the full 127.0.0.0/8 range) to bypass security checks that rely on localhost identification. This could potentially lead to unauthorized access or actions that were intended to be restricted to localhost. However, no known exploits in the wild have been reported.

Upgrade @asymmetric-effort/specifyjs to version 0.2.136 or later, where the localhost detection logic has been corrected to include 'localhost', '127.0.0.1', '[::1]', '0.0.0.0', and the entire 127.x.x.x range. No other mitigation is required as the fix addresses the vulnerability directly.