GHSA-93q6-wwjh-jc6h

Source

https://github.com/advisories/GHSA-93q6-wwjh-jc6h

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-93q6-wwjh-jc6h/GHSA-93q6-wwjh-jc6h.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-93q6-wwjh-jc6h

Aliases

CVE-2026-50290

Published

2026-07-02T19:08:45Z

Modified

2026-09-10T03:51:11Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

@asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString

Details

Finding

Location: core/src/server/render-to-string.ts:307-311

CSS value sanitization stripped expression( and url(javascript: using simple regex, but could be bypassed with CSS unicode escapes (\65xpression(), null bytes, or CSS comments (exp/**/ression().

Mitigating Factor: These CSS injection vectors only work in legacy browsers (IE6-IE10). SpecifyJS targets modern browsers.

Status

Fixed in v0.2.136 — CSS sanitization now normalizes unicode escapes and strips CSS comments before pattern matching. Also checks for behavior:, -moz-binding, and -o-link patterns.

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-02T19:08:45Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

npm / @asymmetric-effort/specifyjs

Package

Name: @asymmetric-effort/specifyjs; View open source insights on deps.dev
Purl: pkg:npm/%40asymmetric-effort/specifyjs

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.2.136

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-93q6-wwjh-jc6h/GHSA-93q6-wwjh-jc6h.json"