CVE-2026-61825 code16/sharp has a stored XSS via data-html-content Sanitizer Bypass
Attacker can inject malicious scripts via stored content in SharpEditorFormField, leading to XSS when viewed by other users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-61825?
CVE-2026-61825 is a high-severity cross-site scripting vulnerability in code16 sharp, published on 24 Sep 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in `SharpEditorFormField`: attacker-controlled content bearing the `data-html-content` attribute can bypass HTML sanitization and preserve executable markup, which may execute when another user views the stored content. The vendor identifies version 9.22.5 as patched; applications that intentionally enable `SharpFormEditorField::RAW_HTML` must continue to sanitize editor content themselves. As a workaround, applications should sanitize all editor content before storing or rendering it, for example with Symfony HtmlSanitizer, and disable RAW_HTML functionality where it is not required.
Weakness: CWE-79
Which versions are affected by CVE-2026-61825?
2 open source packages ship an affected version, including code16/sharp.
| Package | Affected | Fixed in |
|---|---|---|
code16/sharp Packagist | All versions | 9.22.5 |
code16/sharp Packagist | All versions | 9.22.5 |
How do I fix CVE-2026-61825?
Upgrade code16/sharp to 9.22.5 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-61825 being exploited?
There is no known exploitation of CVE-2026-61825 in the wild and no public exploit code.
Sources
Also known as GHSA-vj3q-vp3g-j9c8.