CVE-2026-50290
SpecifyJS is a declarative TypeScript user interface framework.
Published Aug 21, 2026 · updated Oct 14, 2026
SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, CSS value sanitization stripped and using simple regex, but could be bypassed with CSS unicode escapes ( ), null bytes, or CSS comments ( ). These CSS injection vectors only work in legacy browsers (IE6-IE10). SpecifyJS targets modern browsers. Starting in version 0.2.136, CSS sanitization now normalizes unicode escapes and strips CSS comments before pattern matching. Also checks for , , and patterns.
Timeline
Detection, updates, and resolution for this record.
Aug 21, 2026 · NIST NVD
Detected
SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, CSS value sanitization stripped and using simple regex, but could be bypassed with CSS unicode escapes ( ), null bytes, or CSS comments ( ). These CSS injection vectors only work in legacy browsers (IE6-IE10). SpecifyJS targets modern browsers. Starting in version 0.2.136, CSS sanitization now normalizes unic
Oct 14, 2026 · NIST NVD
Updated
SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, CSS value sanitization stripped and using simple regex, but could be bypassed with CSS unicode escapes ( ), null bytes, or CSS comments ( ). These CSS injection vectors only work in legacy browsers (IE6-IE10). SpecifyJS targets modern browsers. Starting in version 0.2.136, CSS sanitization now normalizes unic
Sources
- CVE.orgCVE-2026-50290
Official CVE identifier
cve.org - NIST NVDCVE-2026-50290
SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, CSS value sanitization stripped and using simple regex, but could be bypassed with CSS unicode escapes ( ), null bytes, or CSS comments (`exp/**
nvd.nist.gov