Is CVE-2026-50290 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50290 being exploited in the wild.

How severe is CVE-2026-50290?

Medium severity, with a CVSS score of 4, published 21 August 2026.

Which products and versions are affected?

Asymmetric Effort Specifyjs < 0.2.136; @asymmetric-effort/specifyjs (npm) < 0.2.136, SEMVER:introduced=0,fixed=0.2.136.

Is there a fix for CVE-2026-50290?

Yes. @asymmetric-effort/specifyjs (npm): upgrade to 0.2.136 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-50290 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-50290?

Check whether you run Asymmetric Effort Specifyjs or @asymmetric-effort/specifyjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50290: Asymmetric Effort SpecifyJS CSS sanitization bypass in renderToString

Q: Is there a fix for CVE-2026-50290?

Yes. @asymmetric-effort/specifyjs (npm): upgrade to 0.2.136 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-50290 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-50290?

Check whether you run Asymmetric Effort Specifyjs or @asymmetric-effort/specifyjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50290 · Severity: medium · CVSS 4 · Published 2026-08-21

SpecifyJS, a JavaScript library used for web development, contains a vulnerability in its server-side rendering component. An attacker could bypass security filters to inject malicious CSS code. While this primarily affects users on older web browsers (like Internet Explorer 6-10), it could potentially lead to unauthorized script execution in those environments.

Technologies: Asymmetric Effort Specifyjs, @asymmetric-effort/specifyjs (npm). Vendors: Asymmetric Effort, npm.

Quick answers

Is CVE-2026-50290 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50290 being exploited in the wild.
How severe is CVE-2026-50290?: Medium severity, with a CVSS score of 4, published 21 August 2026.
Which products and versions are affected?: Asymmetric Effort Specifyjs < 0.2.136; @asymmetric-effort/specifyjs (npm) < 0.2.136, SEMVER:introduced=0,fixed=0.2.136.
Is there a fix for CVE-2026-50290?: Yes. @asymmetric-effort/specifyjs (npm): upgrade to 0.2.136 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50290 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-50290?: Check whether you run Asymmetric Effort Specifyjs or @asymmetric-effort/specifyjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@asymmetric-effort/specifyjs (npm): upgrade to 0.2.136 or later
```
npm install @asymmetric-effort/specifyjs@0.2.136
```

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the `renderToString` function of `@asymmetric-effort/specifyjs` due to insufficient sanitization of CSS values. The original implementation used simple regular expressions to strip `expression(` and `url(javascript:`, which could be bypassed using CSS unicode escapes (e.g., `\65xpression(`), null bytes, or CSS comments. While modern browsers are not susceptible to these specific CSS-based execution vectors, legacy browsers (IE6-IE10) may execute the injected code. The vulnerability was fixed in version 0.2.136 by normalizing unicode escapes and stripping comments before pattern matching.

Affected products

asymmetric-effort @asymmetric-effort/specifyjs < 0.2.136

Identifiers

CVE-2026-50290
GHSA-93q6-wwjh-jc6h

Timeline

2026-05-29: disclosed: Vulnerability identified during penetration test code review
2026-05-29: patched: Fixed in version 0.2.136
2026-07-02: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.