CVE-2026-50290

Name of the Vulnerable Software and Affected Versions SpecifyJS versions prior to 0.2.136

Description CSS value sanitization in the core/src/server/render-to-string.ts file used simple regular expressions to strip expression( and url(javascript:, which could be bypassed using null bytes, CSS comments, or CSS unicode escapes. This allows for CSS injection, although the vectors are only effective in legacy browsers such as IE6 through IE10. The issue is addressed by normalizing unicode escapes and stripping CSS comments before pattern matching, and by adding checks for behavior:, -moz-binding, and -o-link patterns.

Recommendations Update SpecifyJS to version 0.2.136 or later.