{"id":"CVE-2026-50290","title":"@asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString","summary":"@asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString","severity":"medium","cwe":["CWE-79"],"vendor":"asymmetric-effort","product":"@asymmetric-effort/specifyjs","ecosystem":"npm","affected":["@asymmetric-effort/specifyjs < 0.2.136"],"patched":["@asymmetric-effort/specifyjs 0.2.136"],"published":"2026-07-02","updated":"2026-07-02","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-93q6-wwjh-jc6h","references":[{"url":"https://github.com/asymmetric-effort/specifyjs/security/advisories/GHSA-93q6-wwjh-jc6h"},{"url":"https://github.com/asymmetric-effort/specifyjs/commit/25d1fb491d99479efdf501f5f75e0bb80c908f0a"},{"url":"https://github.com/advisories/GHSA-93q6-wwjh-jc6h"}],"tags":["ghsa","npm"],"ingestedAt":"2026-07-02T19:41:50.952Z","epss":0.00356,"epssPercentile":0.29437,"slug":"CVE-2026-50290","body":"## Overview\n\n## Finding\n\n**Location**: `core/src/server/render-to-string.ts:307-311`\n\nCSS value sanitization stripped `expression(` and `url(javascript:` using simple regex, but could be bypassed with CSS unicode escapes (`\\65xpression(`), null bytes, or CSS comments (`exp/**/ression(`).\n\n**Mitigating Factor**: These CSS injection vectors only work in legacy browsers (IE6-IE10). SpecifyJS targets modern browsers.\n\n## Status\n\n**Fixed in v0.2.136** — CSS sanitization now normalizes unicode escapes and strips CSS comments before pattern matching. Also checks for `behavior:`, `-moz-binding`, and `-o-link` patterns.\n\n## Affected packages\n\n- `@asymmetric-effort/specifyjs < 0.2.136`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `@asymmetric-effort/specifyjs 0.2.136`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}