[ CVE-2026-61825 · Published 24 Sep 2026 ]
code16/sharp has a stored XSS via data-html-content Sanitizer Bypass
[ Description ]Official description
code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in `SharpEditorFormField`: attacker-controlled content bearing the `data-html-content` attribute can bypass HTML sanitization and preserve executable markup, which may execute when another user views the stored content. The vendor identifies version 9.22.5 as patched; applications that intentionally enable `SharpFormEditorField::RAW_HTML` must continue to sanitize editor content themselves. As a workaround, applications should sanitize all editor content before storing or rendering it, for example with Symfony HtmlSanitizer, and disable RAW_HTML functionality where it is not required.
[ Fixes ]Fixes and patches
- code16/sharp 9.22.5Fixed version · GitHub Advisories · composer package code16/sharp: upgrade to 9.22.5 or later (affected < 9.22.5)
[ Packages ]Affected open-source packages
- code16/sharp composerAffected < 9.22.5 · fixed in 9.22.5 · GHSA-vj3q-vp3g-j9c8