{"uuid": "b68f1658-d102-457b-a32f-91e7675ae1d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-vj3q-vp3g-j9c8", "type": "seen", "source": "https://gist.github.com/alon710/81ebeb26ef49d3bdcb489d52174596c0", "content": "# CVE-2026-61825: CVE-2026-61825: Stored Cross-Site Scripting (XSS) via data-html-content Sanitizer Bypass in code16/sharp\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-09-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61825\n\n## Summary\nCVE-2026-61825 is a high-severity, stored Cross-Site Scripting (XSS) vulnerability identified in code16/sharp, a Laravel-based administrative framework. The flaw resides within the administrative backend's rich-text and markdown editor field formatter. By bypassing HTML sanitization via crafted elements containing the data-html-content attribute or iframe srcdoc execution parameters, lower-privileged users can inject and execute arbitrary JavaScript code.\n\n## TL;DR\nStored Cross-Site Scripting (XSS) in code16/sharp prior to 9.22.5 allows lower-privileged users to bypass HTML sanitization and execute arbitrary JavaScript via crafted elements containing 'data-html-content' or iframe 'srcdoc' attributes.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 8.7\n- **EPSS Score**: 0.00219\n- **Impact**: High (Stored XSS / Session Hijacking / Admin Takeover)\n- **Exploit Status**: Proof-of-Concept (via Unit Tests)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- code16/sharp Laravel Administrative Framework\n- **sharp**: < 9.22.5 (Fixed in: `9.22.5`)\n\n## Mitigation\n\n- Upgrade package dependency to version 9.22.5 or higher.\n- Disable the RAW_HTML toolbar option in all SharpForm text fields.\n- Add strict backend sanitization on content input streams.\n- Deploy WAF rules to inspect and block requests carrying 'data-html-content' or 'srcdoc' attributes.\n\n**Remediation Steps:**\n1. Verify your currently installed version of code16/sharp using 'composer show code16/sharp'.\n2. Run 'composer update code16/sharp' to pull version 9.22.5 or later.\n3. Verify that the update is recorded in composer.lock and commit changes.\n4. Scan codebase for occurrences of 'SharpFormEditorField::RAW_HTML' to confirm configuration safety.\n\n## References\n\n- [GitHub Security Advisory GHSA-vj3q-vp3g-j9c8](https://github.com/code16/sharp/security/advisories/GHSA-vj3q-vp3g-j9c8)\n- [Fix Commit ec509a22](https://github.com/code16/sharp/commit/ec509a22c808a5bd9dfad6a0a85c92ce6f411e21)\n- [CVE-2026-61825 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-61825)\n- [NVD Vulnerability Details for CVE-2026-61825](https://nvd.nist.gov/vuln/detail/CVE-2026-61825)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61825) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T19:30:32.000000Z"}