{"id":"CVE-2026-61825","aliases":["GHSA-vj3q-vp3g-j9c8"],"url":"https://o3.security/vulnerability/CVE-2026-61825","summary":"code16/sharp has a stored XSS via data-html-content Sanitizer Bypass","details":"code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in `SharpEditorFormField`: attacker-controlled content bearing the `data-html-content` attribute can bypass HTML sanitization and preserve executable markup, which may execute when another user views the stored content. The vendor identifies version 9.22.5 as patched; applications that intentionally enable `SharpFormEditorField::RAW_HTML` must continue to sanitize editor content themselves. As a workaround, applications should sanitize all editor content before storing or rendering it, for example with Symfony HtmlSanitizer, and disable RAW_HTML functionality where it is not required.","published":"2026-09-24T18:27:32.284Z","modified":"2026-10-21T02:58:52.913832603Z","cvss":{"score":8.7,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Packagist","name":"code16/sharp","fixedVersion":"9.22.5"}],"fix":{"url":"https://github.com/code16/sharp/commit/ec509a22c808a5bd9dfad6a0a85c92ce6f411e21","label":"code16/sharp@ec509a2"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61825.json"},{"type":"ADVISORY","url":"https://github.com/code16/sharp/security/advisories/GHSA-vj3q-vp3g-j9c8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61825"},{"type":"FIX","url":"https://github.com/code16/sharp/commit/ec509a22c808a5bd9dfad6a0a85c92ce6f411e21"},{"type":"PACKAGE","url":"https://github.com/code16/sharp"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:58:52.913832603Z"}}