The vulnerability (CVE-2026-50290) exists in the renderToString function of @asymmetric-effort/specifyjs versions before 0.2.136. The CSS sanitization logic used simple regex to remove dangerous CSS expressions such as 'expression(' and 'url(javascript:'. However, attackers could bypass this filtering using CSS unicode escapes (e.g., '\65xpression('), null bytes, or CSS comments (e.g., 'exp/**/ression('). These bypass techniques allow injection of unsafe CSS expressions. The vectors are only effective in legacy browsers (IE6-IE10), which are not the target environment for SpecifyJS. The vulnerability is addressed in version 0.2.136 by normalizing unicode escapes, removing CSS comments before pattern matching, and adding checks for additional risky CSS properties like 'behavior:', '-moz-binding', and '-o-link'.

This vulnerability could allow injection of unsafe CSS expressions in affected versions of SpecifyJS, potentially leading to cross-site scripting (XSS) issues in legacy browsers (IE6-IE10). Since SpecifyJS targets modern browsers, the practical impact is limited. There are no known exploits in the wild. The CVSS 4.0 base score is moderate, reflecting the limited attack surface and browser applicability.

A fix is available in version 0.2.136 of @asymmetric-effort/specifyjs. Users should upgrade to version 0.2.136 or later to ensure proper CSS sanitization that normalizes unicode escapes, strips CSS comments, and checks for additional dangerous CSS patterns. No other mitigation is required as the vulnerability only affects legacy browsers not targeted by SpecifyJS.