CVE-2026-50290
Received Received - Intake

CSS Injection Bypass in SpecifyJS

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, CSS value sanitization stripped `expression(` and `url(javascript:` using simple regex, but could be bypassed with CSS unicode escapes (`\65xpression(`), null bytes, or CSS comments (`exp/**/ression(`). These CSS injection vectors only work in legacy browsers (IE6-IE10). SpecifyJS targets modern browsers. Starting in version 0.2.136, CSS sanitization now normalizes unicode escapes and strips CSS comments before pattern matching. Also checks for `behavior:`, `-moz-binding`, and `-o-link` patterns.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-22
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-50290

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
asymmetric-effort specifyjs to 0.2.136 (exc)
specifyjs specifyjs to 0.2.136 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects SpecifyJS, a TypeScript UI framework, in versions before 0.2.136. It involves weak CSS sanitization that could allow CSS-based XSS attacks. Attackers could bypass simple regex filters using unicode escapes, null bytes, or CSS comments to inject malicious CSS expressions. The issue only impacts legacy browsers like IE6-IE10, but was fixed by improving sanitization to normalize unicode escapes, remove CSS comments, and block additional dangerous patterns.

Detection Guidance

Check if your SpecifyJS version is below 0.2.136 by running: npm list @asymmetric-effort/specifyjs. If vulnerable, update to version 0.2.136 or later.

Impact Analysis

If you use SpecifyJS versions prior to 0.2.136, an attacker might exploit this to inject malicious CSS that executes scripts in legacy browsers. This could lead to XSS attacks, potentially stealing user data or session cookies. However, since the vectors only work in old browsers and SpecifyJS targets modern browsers, real-world impact is likely limited.

Compliance Impact

This vulnerability primarily affects legacy browsers (IE6-IE10) and involves CSS-based XSS vectors that are mitigated in modern browsers. It does not directly impact compliance with GDPR or HIPAA as it requires outdated browser environments to exploit and has been patched in current versions. The risk is minimal for modern systems.

Mitigation Strategies

Upgrade SpecifyJS to version 0.2.136 or later. Review CSS sanitization logic if custom implementations exist. Monitor legacy browser usage and restrict access if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50290. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart