From fedcf9e8b14fda90a268bf9c702aaa926c82df88 Mon Sep 17 00:00:00 2001
From: Oliver Walters <oliver.henry.walters@gmail.com>
Date: Mon, 6 Jul 2026 12:51:49 +0000
Subject: [PATCH] Manual cleaning update

---
 src/backend/InvenTree/common/models.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/backend/InvenTree/common/models.py b/src/backend/InvenTree/common/models.py
index 56ddf77bf1..e9e30d1f42 100644
--- a/src/backend/InvenTree/common/models.py
+++ b/src/backend/InvenTree/common/models.py
@@ -10,6 +10,7 @@ import hmac
 import json
 import math
 import os
+import re
 import uuid
 from collections import OrderedDict
 from datetime import timedelta, timezone
@@ -3130,6 +3131,12 @@ class Note(
                 },
             )
 
+            # nh3 does not recognise legacy IE-only CSS expression() calls as
+            # unsafe, so they survive style attribute filtering - strip them explicitly
+            self.content = re.sub(
+                r'expression\s*\(', '', self.content, flags=re.IGNORECASE
+            )
+
     def check_save(self):
         """Check if this note can be saved."""
         from InvenTree.models import InvenTreeNoteMixin