All vulnerabilities
CVE-2026-61825GHSA-vj3q-vp3g-j9c8

code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

code16 code16/sharpcomposerLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in9.22.5Fixed versionGitHub
Published24 Sep 2026Updated 25 Sep 2026CVE List

What fixes it

  • 9.22.5code16/sharp, composerGitHubcomposer require "code16/sharp:^9.22.5"
  • 9.22.5code16/sharp, PackagistOSVcomposer require "code16/sharp:^9.22.5"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

The vulnerability allows an attacker to bypass the HTML sanitizer by using the data-html-content attribute in the content of a SharpEditorFormField.

Patches

The field must now explicitly configure SharpFormEditorField::RAW_HTML in the toolbar to keep this behavior. **When using the RAW_HTML button, the application using code16/sharp must sanitize manually the content coming from the field**. Vulnerability has been patched in version 9.22.5.

Workarounds

Sanitize every contents of editors manually (e.g. using Symfony/HtmlSanitizer)

Text from GitHub Advisory Database

Affected versions 53

  • code16/sharp, composer< 9.22.5GitHub
  • sharpaffected: < 9.22.5CVE List
  • code16/sharp, Packagistfrom first release, fixed in 9.22.5OSV
  • code16/sharp, Packagist7.0.0-alpha.1OSV
  • code16/sharp, Packagist7.27.0OSV
  • code16/sharp, Packagist7.7.2OSV
  • code16/sharp, Packagistv4.0-BETA1OSV
  • code16/sharp, Packagistv4.0-BETA2OSV
  • code16/sharp, Packagistv4.0-BETA3OSV
  • code16/sharp, Packagistv4.0-BETA4OSV
  • code16/sharp, Packagistv4.0-BETA5OSV
  • code16/sharp, Packagistv4.0-BETA6OSV
  • code16/sharp, Packagistv4.0.0OSV
  • code16/sharp, Packagistv4.0.1OSV
  • code16/sharp, Packagistv4.0.10OSV
  • code16/sharp, Packagistv4.0.11OSV
  • code16/sharp, Packagistv4.0.12OSV
  • code16/sharp, Packagistv4.0.13OSV
  • code16/sharp, Packagistv4.0.14OSV
  • code16/sharp, Packagistv4.0.15OSV
  • code16/sharp, Packagistv4.0.16OSV
  • code16/sharp, Packagistv4.0.17OSV
  • code16/sharp, Packagistv4.0.18OSV
  • code16/sharp, Packagistv4.0.19OSV
  • code16/sharp, Packagistv4.0.2OSV
  • code16/sharp, Packagistv4.0.20OSV
  • code16/sharp, Packagistv4.0.21OSV
  • code16/sharp, Packagistv4.0.3OSV
  • code16/sharp, Packagistv4.0.4OSV
  • code16/sharp, Packagistv4.0.5OSV
  • code16/sharp, Packagistv4.0.6OSV
  • code16/sharp, Packagistv4.0.7OSV
  • code16/sharp, Packagistv4.0.8OSV
  • code16/sharp, Packagistv4.0.9OSV
  • code16/sharp, Packagistv4.1.0OSV
  • code16/sharp, Packagistv4.1.1OSV
  • code16/sharp, Packagistv4.1.10OSV
  • code16/sharp, Packagistv4.1.11OSV
  • code16/sharp, Packagistv4.1.12OSV
  • code16/sharp, Packagistv4.1.13OSV
  • code16/sharp, Packagistv4.1.14OSV
  • code16/sharp, Packagistv4.1.15OSV
  • code16/sharp, Packagistv4.1.16OSV
  • code16/sharp, Packagistv4.1.17OSV
  • code16/sharp, Packagistv4.1.18OSV
  • code16/sharp, Packagistv4.1.19OSV
  • code16/sharp, Packagistv4.1.2OSV
  • code16/sharp, Packagistv4.1.20OSV
  • code16/sharp, Packagistv4.1.21OSV
  • code16/sharp, Packagistv4.1.22OSV
  • code16/sharp, Packagistv4.1.23OSV
  • code16/sharp, Packagistv4.1.24OSV
  • code16/sharp, Packagistv4.1.25OSV

References 4