specifyjs
CVEs (2)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-50288 | hig | 0.45 | — | — | Jul 2, 2026 | ## Finding **Location**: `core/src/shared/secure-fetch.ts:42-45` When `new URL()` throws a parse error, the `assertSecureUrl` function returned without throwing, silently allowing the request to proceed without HTTPS validation. ## Status **Fixed in v0.2.136** — The catch… | ||
| CVE-2026-50290 | med | 0.26 | — | — | Jul 2, 2026 | ## Finding **Location**: `core/src/server/render-to-string.ts:307-311` CSS value sanitization stripped `expression(` and `url(javascript:` using simple regex, but could be bypassed with CSS unicode escapes (`\65xpression(`), null bytes, or CSS comments (`exp/**/ression(`). … |
- risk 0.45cvss —epss —
## Finding **Location**: `core/src/shared/secure-fetch.ts:42-45` When `new URL()` throws a parse error, the `assertSecureUrl` function returned without throwing, silently allowing the request to proceed without HTTPS validation. ## Status **Fixed in v0.2.136** — The catch…
- risk 0.26cvss —epss —
## Finding **Location**: `core/src/server/render-to-string.ts:307-311` CSS value sanitization stripped `expression(` and `url(javascript:` using simple regex, but could be bypassed with CSS unicode escapes (`\65xpression(`), null bytes, or CSS comments (`exp/**/ression(`). …