{"schema":"threatline.record/2","record":{"id":"CVE-2026-61825","aliases":["GHSA-vj3q-vp3g-j9c8"],"summary":"code16/sharp has a stored XSS via data-html-content Sanitizer Bypass","details":"### Impact\nThe vulnerability allows an attacker to bypass the HTML sanitizer by using the `data-html-content` attribute in the content of a `SharpEditorFormField`. \n\n### Patches\nThe field must now explicitly configure `SharpFormEditorField::RAW_HTML` in the toolbar to keep this behavior. **When using the  `RAW_HTML` button, the application using `code16/sharp` must sanitize manually the content coming from the field**. \nVulnerability has been patched in version 9.22.5.\n\n### Workarounds\nSanitize every contents of editors manually (e.g. using Symfony/HtmlSanitizer)","categories":["Libraries & packages"],"product":"code16/sharp","vendor":"code16","ecosystem":"composer","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-vj3q-vp3g-j9c8","source_modified_at":"2026-09-25T15:00:45Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"code16/sharp"},"range":"< 9.22.5"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-61825","source_modified_at":"2026-09-24T18:53:39.208Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"sharp","vendor":"code16","versions":[{"version":"< 9.22.5","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-vj3q-vp3g-j9c8","source_modified_at":"2026-09-25T15:15:06.238904798Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"code16/sharp","purl":"pkg:composer/code16/sharp"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"9.22.5"}],"type":"ECOSYSTEM"}],"versions":["7.0.0-alpha.1","7.27.0","7.7.2","v4.0-BETA1","v4.0-BETA2","v4.0-BETA3","v4.0-BETA4","v4.0-BETA5","v4.0-BETA6","v4.0.0","v4.0.1","v4.0.10","v4.0.11","v4.0.12","v4.0.13","v4.0.14","v4.0.15","v4.0.16","v4.0.17","v4.0.18","v4.0.19","v4.0.2","v4.0.20","v4.0.21","v4.0.3","v4.0.4","v4.0.5","v4.0.6","v4.0.7","v4.0.8","v4.0.9","v4.1.0","v4.1.1","v4.1.10","v4.1.11","v4.1.12","v4.1.13","v4.1.14","v4.1.15","v4.1.16","v4.1.17","v4.1.18","v4.1.19","v4.1.2","v4.1.20","v4.1.21","v4.1.22","v4.1.23","v4.1.24","v4.1.25"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-vj3q-vp3g-j9c8","source_modified_at":"2026-09-25T15:00:45Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"code16/sharp"},"version":"9.22.5"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-vj3q-vp3g-j9c8","source_modified_at":"2026-09-25T15:15:06.238904798Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"code16/sharp","purl":"pkg:composer/code16/sharp"},"version":"9.22.5"}],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00219,"percentile":0.11788,"score_date":"2026-10-23"},"published_at":"2026-09-24T18:27:32.284Z","modified_at":"2026-09-25T15:15:06.238904798Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-vj3q-vp3g-j9c8","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-25T15:00:45Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-61825","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-24T18:53:39.208Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-vj3q-vp3g-j9c8","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-25T15:15:06.238904798Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-61825","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/code16/sharp/security/advisories/GHSA-vj3q-vp3g-j9c8","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61825","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/code16/sharp/commit/ec509a22c808a5bd9dfad6a0a85c92ce6f411e21","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-vj3q-vp3g-j9c8","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-09-24T18:53:19.093005Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-25T15:15:06.238904798Z","content_hash":"f341207a5bb353cbcbb795f6630509c1f9cfe82c15b36a46444ed2324cf878c4"}}