Threats Tagged 'ghsa-93q6-wwjh-jc6h'
View all threats tagged with 'ghsa-93q6-wwjh-jc6h'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'ghsa-93q6-wwjh-jc6h'
Click on any threat for detailed analysis and mitigation recommendations
GHSA-93q6-wwjh-jc6h: @asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToStringCVE-2026-50290 0 A vulnerability in @asymmetric-effort/specifyjs prior to version 0.2.136 allows bypass of CSS expression sanitization in the renderToString function. The sanitization attempted to strip dangerous CSS expressions like 'expression(' and 'url(javascript:' using simple regex, but attackers could bypass this using CSS unicode escapes, null bytes, or CSS comments. These injection vectors only affect legacy browsers (IE6-IE10), while SpecifyJS targets modern browsers. The issue is fixed in version 0.2.136 by normalizing unicode escapes, stripping CSS comments before matching, and checking additional dangerous CSS patterns. Join the discussion | GCVE Database | 07/02/2026, 19:08:45 UTC Added: 07/02/2026, 22:56:59 UTC |
Showing 1 to 1 of 1 result