{"uuid": "017b2c21-65f6-48ff-b0a7-41276f76fce3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61823", "type": "seen", "source": "https://gist.github.com/alon710/4cf0072fd72e5b7220c9b813b7fb1aa2", "content": "# CVE-2026-61823: CVE-2026-61823: Stored Cross-Site Scripting (XSS) via iframe srcdoc Attribute in code16 Sharp\n\n> **CVSS Score:** 7.3\n> **Published:** 2026-09-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61823\n\n## Summary\nA stored cross-site scripting (XSS) vulnerability was identified in the content-management and administrative framework code16 Sharp. The flaw stems from an overly permissive HTML sanitization configuration that whitelists the 'srcdoc' attribute on HTML 'iframe' tags. When processed and stored, browsers render the content of this attribute by decoding nested HTML entities, converting sanitized elements back into executable code.\n\n## TL;DR\nA stored cross-site scripting vulnerability in code16 Sharp allows authenticated users to inject arbitrary JavaScript via the 'srcdoc' attribute of an 'iframe' in rich-text fields. This bypasses backend sanitization because web browsers decode HTML entities within this attribute before execution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network (N)\n- **CVSS Score**: 7.3\n- **EPSS Score**: 0.0021\n- **EPSS Percentile**: 10.08%\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- code16/sharp\n- **sharp**: < 9.22.5 (Fixed in: `9.22.5`)\n\n## Mitigation\n\n- Upgrade code16/sharp to version 9.22.5 or higher\n- Deploy custom server-side middleware to sanitize or strip the srcdoc attribute from incoming HTML payloads\n- Configure Content Security Policy (CSP) headers to restrict frame sources and script execution context\n\n**Remediation Steps:**\n1. Open the terminal in the application root directory.\n2. Execute the command: composer update code16/sharp\n3. Verify the installed version is 9.22.5 or higher in the composer.lock file.\n4. Inspect custom rich-text configurations to ensure RAW_HTML properties are only granted to trusted administrative roles.\n\n## References\n\n- [GitHub Security Advisory GHSA-qxg3-46rw-79j8](https://github.com/code16/sharp/security/advisories/GHSA-qxg3-46rw-79j8)\n- [NVD CVE-2026-61823 Reference Record](https://nvd.nist.gov/vuln/detail/CVE-2026-61823)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61823) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T18:30:32.000000Z"}