{"id":"EUVD-2026-64123","enisaUuid":"2b544e07-8369-332b-b29d-acc3f13601e2","description":"SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, CSS value sanitization stripped `expression(` and `url(javascript:` using simple regex, but could be bypassed with CSS unicode escapes (`\\65xpression(`), null bytes, or CSS comments (`exp/**/ression(`). These CSS injection vectors only work in legacy browsers (IE6-IE10). SpecifyJS targets modern browsers. Starting in version 0.2.136, CSS sanitization now normalizes unicode escapes and strips CSS comments before pattern matching. Also checks for `behavior:`, `-moz-binding`, and `-o-link` patterns.","datePublished":"Aug 21, 2026, 7:55:51 PM","dateUpdated":"Aug 21, 2026, 8:07:10 PM","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/asymmetric-effort/specifyjs/security/advisories/GHSA-93q6-wwjh-jc6h\nhttps://github.com/asymmetric-effort/specifyjs/commit/25d1fb491d99479efdf501f5f75e0bb80c908f0a\n","aliases":"CVE-2026-50290\nGHSA-93q6-wwjh-jc6h\n","assigner":"GitHub_M","epss":0.49,"enisaIdProduct":[{"id":"de8f9b35-db6d-32dd-93d0-16949fc9eb1c","product":{"name":"specifyjs","vendor":{"name":"asymmetric-effort"}},"product_version":"\u003c 0.2.136"}],"enisaIdVendor":[{"id":"c2219b5f-d486-3e67-8a23-72c51b6432c8","vendor":{"name":"asymmetric-effort"}}],"enisaIdVulnerability":[{"id":"37841b21-0f30-3127-b50a-0385ae4e4c10","vulnerability":{"id":"GHSA-93q6-wwjh-jc6h","description":"@asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString","datePublished":"Jul 2, 2026, 7:08:45 PM","dateUpdated":"Jul 2, 2026, 7:08:45 PM","baseScore":0.0,"references":"https://github.com/asymmetric-effort/specifyjs/security/advisories/GHSA-93q6-wwjh-jc6h\nhttps://github.com/asymmetric-effort/specifyjs/commit/25d1fb491d99479efdf501f5f75e0bb80c908f0a\nhttps://github.com/asymmetric-effort/specifyjs\n","enisa_id":"EUVD-2026-64123\n","aliases":"CVE-2026-50290\nGHSA-93q6-wwjh-jc6h\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"4f2bd7ed-d2c7-3003-99ab-789e3ef6d63e","vulnerability":{"id":"CVE-2026-50290","description":"SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, CSS value sanitization stripped `expression(` and `url(javascript:` using simple regex, but could be bypassed with CSS unicode escapes (`\\65xpression(`), null bytes, or CSS comments (`exp/**/ression(`). These CSS injection vectors only work in legacy browsers (IE6-IE10). SpecifyJS targets modern browsers. Starting in version 0.2.136, CSS sanitization now normalizes unicode escapes and strips CSS comments before pattern matching. Also checks for `behavior:`, `-moz-binding`, and `-o-link` patterns.","datePublished":"Aug 21, 2026, 7:55:51 PM","dateUpdated":"Aug 21, 2026, 8:07:10 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/asymmetric-effort/specifyjs/security/advisories/GHSA-93q6-wwjh-jc6h\nhttps://github.com/asymmetric-effort/specifyjs/commit/25d1fb491d99479efdf501f5f75e0bb80c908f0a\n","enisa_id":"EUVD-2026-64123\n","assigner":"GitHub_M","epss":0.49,"dataProcessed":"Nov 5, 2026, 7:15:46 AM","vulnerabilityProduct":[{"id":"8e11358e-d033-3962-88b0-40e6c0ab431f","product":{"name":"specifyjs","vendor":{"name":"asymmetric-effort"}},"product_version":"\u003c 0.2.136"}],"vulnerabilityVendor":[{"id":"8b11d4d0-60a9-3678-8a99-41aa8e339d21","vendor":{"name":"asymmetric-effort"}}]}}],"enisaIdAdvisory":[]}