CyberRota Analysis
AI-GeneratedThe vulnerability affects SpecifyJS versions prior to 0.2.136, allowing CSS injection through bypass techniques such as CSS unicode escapes and comments, primarily in legacy browsers (IE6-IE10). This could lead to potential cross-site scripting (XSS) attacks, compromising the integrity of web applications using this framework. Developers and organizations utilizing SpecifyJS should prioritize upgrading to version 0.2.136 or later to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, CSS value sanitization stripped `expression(` and `url(javascript:` using simple regex, but could be bypassed with CSS unicode escapes (`\65xpression(`), null bytes, or CSS comments (`exp/**/ression(`). These CSS injection vectors only work in legacy browsers (IE6-IE10). SpecifyJS targets modern browsers. Starting in version 0.2.136, CSS sanitization now normalizes unicode escapes and strips CSS comments before pattern matching. Also checks for `behavior:`, `-moz-binding`, and `-o-link` patterns.