PT-2026-55466 · Npm · @Asymmetric-Effort/Specifyjs

Published 2026-07-02 · Updated 2026-07-02 · CVE-2026-50290

OSV

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Finding

Location: core/src/server/render-to-string.ts:307-311

CSS value sanitization stripped expression( and url(javascript: using simple regex, but could be bypassed with CSS unicode escapes (65xpression(), null bytes, or CSS comments (exp/**/ression().

Mitigating Factor: These CSS injection vectors only work in legacy browsers (IE6-IE10). SpecifyJS targets modern browsers.

Status

Fixed in v0.2.136 — CSS sanitization now normalizes unicode escapes and strips CSS comments before pattern matching. Also checks for behavior:, -moz-binding, and -o-link patterns.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-50290

GHSA-93Q6-WWJH-JC6H

Affected Products

@Asymmetric-Effort/Specifyjs

References · 4

• https://osv.dev/vulnerability/GHSA-93q6-wwjh-jc6h · Vendor Advisory
• https://github.com/asymmetric-effort/specifyjs · Note
• https://github.com/asymmetric-effort/specifyjs/security/advisories/GHSA-93q6-wwjh-jc6h · Note
• https://github.com/asymmetric-effort/specifyjs/commit/25d1fb491d99479efdf501f5f75e0bb80c908f0a · Note