The vulnerability exists in the renderToString method of @asymmetric-effort/specifyjs where CSS value sanitization was insufficient. The original sanitization used simple regex patterns to remove 'expression(' and 'url(javascript:', but this was bypassable via CSS unicode escapes (e.g., '\65xpression('), null bytes, or CSS comments (e.g., 'exp/**/ression('). This could allow CSS injection attacks, classified under CWE-79 (Cross-site Scripting). However, these injection methods only work on legacy browsers (IE6-IE10), which are not the target environment for SpecifyJS. The vulnerability is addressed in version 0.2.136 by enhancing sanitization to normalize unicode escapes, remove CSS comments before pattern matching, and detect additional risky CSS properties like 'behavior:', '-moz-binding', and '-o-link'.

The vulnerability allows bypassing CSS sanitization, potentially enabling CSS injection attacks. However, the impact is limited because the injection vectors only work on legacy browsers (IE6-IE10), which SpecifyJS does not target. There are no known exploits in the wild. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, and low scope and impact, resulting in a moderate severity rating.

A fix is available in @asymmetric-effort/specifyjs version 0.2.136. Users should upgrade to version 0.2.136 or later to benefit from improved CSS sanitization that normalizes unicode escapes, strips CSS comments before matching, and checks for additional dangerous CSS patterns. No other mitigation is required as the vulnerability is fixed in this version.