PT-2026-55466 · Npm+2 · @Asymmetric-Effort/Specifyjs+1
CVE-2026-50290
·
Published
2026-07-02
·
Updated
2026-08-21
CVSS v4.0
5.3
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
SpecifyJS versions prior to 0.2.136
Description
CSS value sanitization in the
core/src/server/render-to-string.ts file used simple regular expressions to strip expression( and url(javascript:, which could be bypassed using null bytes, CSS comments, or CSS unicode escapes. This allows for CSS injection, although the vectors are only effective in legacy browsers such as IE6 through IE10. The issue is addressed by normalizing unicode escapes and stripping CSS comments before pattern matching, and by adding checks for behavior:, -moz-binding, and -o-link patterns.Recommendations
Update SpecifyJS to version 0.2.136 or later.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
@Asymmetric-Effort/Specifyjs
Specifyjs