CSS Injection Vulnerability in SpecifyJS Framework
CVE-2026-50290

5.3MEDIUM

Key Information:

Vendor

Asymmetric-effort

Status
Specifyjs
Vendor
CVE Published:
21 August 2026

What is CVE-2026-50290?

The SpecifyJS framework, a declarative TypeScript user interface tool, was found to have vulnerabilities in its CSS sanitization method prior to version 0.2.136. Attackers could exploit this weakness using CSS unicode escapes and other methods to bypass sanitization during rendering in legacy browsers, specifically Internet Explorer versions 6 through 10. The vulnerability allowed for the injection of malicious CSS through constructs like expression( and url(javascript:. However, with the release of version 0.2.136, SpecifyJS improved its security protocols by normalizing unicode escapes, stripping CSS comments, and implementing additional pattern checks to prevent these types of attacks.

Affected Version(s)

specifyjs < 0.2.136

References

https://github.com/asymmetric-effort/specifyjs/security/a...
x_refsource_CONFIRM
https://github.com/asymmetric-effort/specifyjs/commit/25d...
x_refsource_MISC

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.