CVE-2026-50290
1 advisory.
npm/@asymmetric-effort/specifyjs CVE-2026-50290: medium, EPSS 0.49%
@asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString
Action: Upgrade @asymmetric-effort/specifyjs to 0.2.136 or later.
npm i @asymmetric-effort/specifyjs@0.2.136Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.2.136 | - |
Fixed versions
| 0.2.136 |
Sources
- osv: GHSA-93q6-wwjh-jc6h
- https://github.com/asymmetric-effort/specifyjs/security/advisories/GHSA-93q6-wwjh-jc6h
- https://github.com/asymmetric-effort/specifyjs/commit/25d1fb491d99479efdf501f5f75e0bb80c908f0a
- https://github.com/asymmetric-effort/specifyjs
CVE-2026-50290 · published · modified · JSON