SpecifyJS, a TypeScript UI framework, performed CSS sanitization that removed literal expression( and url(javascript:( patterns using a simple regex. Attackers could bypass this mitigation via Unicode escapes, null bytes, or CSS comments, allowing CSS injection in legacy browsers (IE6‑IE10). The vulnerability was rated moderate with CVSS 5.3. Bypassing sanitization exposes the application to style injection that could compromise UI integrity or, in worst‑case scenarios, data leakage if CSS executed user‑supplied scripts.

Vulnerable releases are those of the asymmetric‑effort:specifyjs product preceding 0.2.136. Any application that integrates specifyjs version 0.2.135 or older is at risk. The fix is included starting with 0.2.136, which normalizes unicode escapes, removes comments before matching, and checks additional patterns such as behavior:, -moz-binding, and -o-link.

The attack surface is restricted to environments running legacy Internet Explorer variants, as modern browsers ignore the expression() and javascript: constructs. Because SpecifyJS is intended for modern browsers, the practical exploitability in current deployments is low. EPSS data is unavailable and the vulnerability is not listed in CISA KEV, further indicating limited active exploitation. However, any legacy browser support should be treated cautiously until the application is upgraded.