https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T19:55:52.178186+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-50290 CVE-2026-50290 — @asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString 2026-10-16T19:55:52.193143+00:00

Affected: asymmetric-effort specifyjs

SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, CSS value sanitization stripped `expression(` and `url(javascript:` using simple regex, but could be bypassed with CSS unicode escapes (`\65xpression(`), null bytes, or CSS comments (`exp/**/ression(`). These CSS injection vectors only work in legacy browsers (IE6-IE10). SpecifyJS targets modern browsers. Starting in version 0.2.136, CSS sanitization now normalizes unicode escapes and strips CSS comments before pattern matching. Also checks for `behavior:`, `-moz-binding`, and `-o-link` patterns.