{"id":"CVE-2025-62798","aliases":["GHSA-9f58-4465-23c7"],"url":"https://o3.security/vulnerability/CVE-2025-62798","summary":"Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax","details":"A Cross-Site Scripting (XSS) vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component.\n\nIn affected versions, expressions wrapped in `{{` & `}}` were evaluated by Vue. This allowed attackers to inject arbitrary JavaScript or HTML that executes in the browser when the field is displayed.\n\nFor example, if a field’s value contains `{{ Math.random() }}`, it will be executed instead of being displayed as text.\n\n### Impact\n\nAttackers who can control content rendered through SharpShowTextField could execute arbitrary JavaScript in the context of an authenticated user’s browser.\n\nThis could lead to:\n\n- Theft of user session tokens.\n- Unauthorized actions performed on behalf of users.\n- Injection of malicious content into the admin panel.\n\n### Patches\n\nThe issue has been fixed in v9.11.1 of code16/sharp package.\n\n### Mitigation / Workarounds\n\nSanitize or encode any user-provided data that may include (`{{` & `}}`) before displaying it in a SharpShowTextField.","published":"2025-10-28T20:58:21.793Z","modified":"2026-08-12T03:51:38.016608215Z","cvss":{"score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"code16/sharp","fixedVersion":"9.11.1"}],"fix":{"url":"https://github.com/code16/sharp/pull/654","label":"code16/sharp#654"},"references":[{"type":"WEB","url":"https://github.com/code16/sharp/releases/tag/v9.11.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62798.json"},{"type":"ADVISORY","url":"https://github.com/code16/sharp/security/advisories/GHSA-9f58-4465-23c7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62798"},{"type":"FIX","url":"https://github.com/code16/sharp/pull/654"},{"type":"WEB","url":"https://github.com/ViktorMares/vue-js-xss-payload-list"},{"type":"PACKAGE","url":"https://github.com/code16/sharp"},{"type":"WEB","url":"https://medium.com/@sid0krypt/vue-js-reflected-xss-fae04c9872d2"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:38.016608215Z"}}