@asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString

Description

Location: core/src/server/render-to-string.ts:307-311

CSS value sanitization stripped expression( and url(javascript: using simple regex, but could be bypassed with CSS unicode escapes (\65xpression(), null bytes, or CSS comments (exp/**/ression().

Recommendation

Update the @asymmetric-effort/specifyjs package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.2.136
• Patched version(s): 0.2.136

References

• GHSA-93q6-wwjh-jc6h
• CVE-2026-50290
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• @asymmetric-effort/specifyjs: URL parse failure silently allows request - CVE-2026-50288
• @asymmetric-effort/specifyjs: Production console warnings may leak internal framework state - Vulnerability
• @asymmetric-effort/specifyjs: No redirect target validation in secureFetch - Vulnerability
• @asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection - Vulnerability

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@asymmetric-effort/specifyjs