~ / search / GHSA-vj3q-vp3g-j9c8

GHSA-vj3q-vp3g-j9c8

code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

Source: GitHub Advisory Database (reviewed) High CVE-2026-61825

Packages

EcosystemPackageAffectedFixed in
Packagist code16/sharp < 9.22.5 9.22.5

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The vulnerability allows an attacker to bypass the HTML sanitizer by using the `data-html-content` attribute in the content of a `SharpEditorFormField`. ### Patches The field must now explicitly configure `SharpFormEditorField::RAW_HTML` in the toolbar to keep this behavior. **When using the `RAW_HTML` button, the application using `code16/sharp` must sanitize manually the content coming from the field**. Vulnerability has been patched in version 9.22.5. ### Workarounds Sanitize every contents of editors manually (e.g. using Symfony/HtmlSanitizer)

References

External links from the advisory. They lead to third-party sites.