GitHub Advisoryadvisory · npm

GHSA-93q6-wwjh-jc6h @asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString

MEDIUM Published 2026-07-02 Modified 2026-07-02 Official page ↗
Aliases
CVE-2026-50290
Ecosystem
npm
Packages
@asymmetric-effort/specifyjs
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weaknesses
CWE-79
Reviewed
2026-07-02

Affected packages

• npm @asymmetric-effort/specifyjs: < 0.2.136 → fixed in 0.2.136

Description

Finding Location: `core/src/server/render-to-string.ts:307-311` CSS value sanitization stripped `expression(` and `url(javascript:` using simple regex, but could be bypassed with CSS unicode escapes (`\65xpression(`), null bytes, or CSS comments (`exp//ression(`). Mitigating Factor: These CSS injection vectors only work in legacy browsers (IE6-IE10). SpecifyJS targets modern browsers. Status Fixed in v0.2.136** — CSS sanitization now normalizes unicode escapes and strips CSS comments before pattern matching. Also checks for `behavior:`, `-moz-binding`, and `-o-link` patterns.

Related

Alias · CVE (1)

  • CVE-2026-50290 SpecifyJS is a declarative TypeScript user interface framework. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References