{"id":"CVE-2026-50290","title":"SpecifyJS is a declarative TypeScript user interface framework","summary":"SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, CSS value sanitization stripped `expression(` and `url(javascript:` using simple regex, but could be bypassed with CSS unicode escapes (`\\65xpressi…","severity":"medium","cwe":["CWE-79"],"vendor":"asymmetric-effort","product":"@asymmetric-effort/specifyjs","affected":["@asymmetric-effort/specifyjs < 0.2.136"],"patched":["@asymmetric-effort/specifyjs 0.2.136"],"published":"2026-08-21","updated":"2026-10-14","sourceUpdated":"2026-10-14T19:10:00.297","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-50290","references":[{"url":"https://github.com/asymmetric-effort/specifyjs/commit/25d1fb491d99479efdf501f5f75e0bb80c908f0a","label":"security-advisories@github.com"},{"url":"https://github.com/asymmetric-effort/specifyjs/security/advisories/GHSA-93q6-wwjh-jc6h","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-93q6-wwjh-jc6h"}],"tags":["nvd","ghsa","npm"],"epss":0.00489,"epssPercentile":0.41904,"ecosystem":"npm","ingestedAt":"2026-07-02T19:41:50.952Z","slug":"CVE-2026-50290","body":"## Overview\n\nSpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, CSS value sanitization stripped `expression(` and `url(javascript:` using simple regex, but could be bypassed with CSS unicode escapes (`\\65xpression(`), null bytes, or CSS comments (`exp/**/ression(`). These CSS injection vectors only work in legacy browsers (IE6-IE10). SpecifyJS targets modern browsers. Starting in version 0.2.136, CSS sanitization now normalizes unicode escapes and strips CSS comments before pattern matching. Also checks for `behavior:`, `-moz-binding`, and `-o-link` patterns.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-50290)\n\nAffected packages:\n\n- `@asymmetric-effort/specifyjs < 0.2.136`\n\nPatched in:\n\n- `@asymmetric-effort/specifyjs 0.2.136`\n\nSource: https://github.com/advisories/GHSA-93q6-wwjh-jc6h","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}