Is code16/sharp affected by CVE-2026-61823?

Packagist code16/sharp is affected in < 9.22.5.

Is CVE-2026-61823 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.2%.

← All vulnerabilities

HIGHSupply chain

CVE-2026-61823

Q: Is CVE-2026-61823 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.2%.

Packagist · code16/sharp

Summary

code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

Advisory details

Impact

A Stored Cross-Site Scripting (XSS) vulnerability exists in the rich text editor due to improper sanitization of the srcdoc attribute on elements.</p> <p>While the underlying Symfony HtmlSanitizer correctly HTML-encodes special characters inside the attribute value (e.g., converting <script> to <script>), the HTML specification mandates that browsers automatically decode HTML entities inside attribute values before processing them. As a result, any encoded JavaScript inside a srcdoc attribute is evaluated and executed as live HTML/JS in the context of the iframe when the page is rendered.</p> <p>An attacker with permissions to edit an Editor field can inject malicious scripts to target other users viewing the content. Potential impacts include:</p> <ul> <li>Session Hijacking (stealing admin session cookies via document.cookie)</li> <li>Account Takeover & Privilege Escalation (e.g., a low-privileged editor triggering actions as an Administrator)</li> <li>Admin panel data theft</li> </ul> <h3>Patches</h3> <p>The vulnerability has been patched in version v9.22.5.</p> <p>The fix explicitly removes srcdoc from the list of allowed iframe attributes in <code>src/Utils/Sanitization/FormatsSanitizedValue.php</code>.</p> <h3>Workarounds</h3> <p>Users who cannot upgrade immediately can manually sanitize all content of editor fields to strip <code>srcdoc</code> attributes.</p> </div><h2 class="mt-8 font-mono text-xs uppercase tracking-wider text-ink-faint">References</h2><ul class="mt-3 space-y-1"><li><a href="https://github.com/advisories/GHSA-qxg3-46rw-79j8" target="_blank" rel="noopener noreferrer" class="break-all text-sm text-scan hover:underline">https://github.com/advisories/GHSA-qxg3-46rw-79j8</a></li><li><a href="https://github.com/code16/sharp/security/advisories/GHSA-qxg3-46rw-79j8" target="_blank" rel="noopener noreferrer" class="break-all text-sm text-scan hover:underline">https://github.com/code16/sharp/security/advisories/GHSA-qxg3-46rw-79j8</a></li><li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-61823" target="_blank" rel="noopener noreferrer" class="break-all text-sm text-scan hover:underline">https://nvd.nist.gov/vuln/detail/CVE-2026-61823</a></li><li><a href="https://github.com/code16/sharp/commit/ec509a22c808a5bd9dfad6a0a85c92ce6f411e21" target="_blank" rel="noopener noreferrer" class="break-all text-sm text-scan hover:underline">https://github.com/code16/sharp/commit/ec509a22c808a5bd9dfad6a0a85c92ce6f411e21</a></li></ul></div><aside class="space-y-4"><div class="rounded-2xl border border-line bg-surface p-5 font-mono text-sm"><div class="flex justify-between gap-3 border-b border-line py-1.5 last:border-0"><span class="text-ink-faint">Source</span><span class="text-right text-ink">Stateward</span></div><div class="flex justify-between gap-3 border-b border-line py-1.5 last:border-0"><span class="text-ink-faint">Severity</span><span class="text-right text-ink">high</span></div><div class="flex justify-between gap-3 border-b border-line py-1.5 last:border-0"><span class="text-ink-faint">CVSS</span><span class="text-right text-ink">7.3</span></div><div class="flex justify-between gap-3 border-b border-line py-1.5 last:border-0"><span class="text-ink-faint">EPSS</span><span class="text-right text-ink">0.2% (p11)</span></div><div class="flex justify-between gap-3 border-b border-line py-1.5 last:border-0"><span class="text-ink-faint">Also known as</span><span class="text-right text-ink">GHSA-qxg3-46rw-79j8</span></div><div class="flex justify-between gap-3 border-b border-line py-1.5"><span class="text-ink-faint">CWE</span><span class="text-right"><span><a href="/cwe/79" class="text-scan hover:underline">CWE-79</a></span></span></div><div class="flex justify-between gap-3 border-b border-line py-1.5 last:border-0"><span class="text-ink-faint">Added</span><span class="text-right text-ink">2026-09-25</span></div></div><div class="rounded-2xl border border-scan/30 bg-scan/5 p-5"><p class="text-sm text-ink">Is your project exposed to this? Stateward checks every dependency on every pull request, and flags it only if your code actually reaches it.</p><a href="https://app.stateward.com" target="_blank" rel="noopener noreferrer" class="inline-flex items-center justify-center gap-2 rounded-lg px-6 py-3 text-sm font-semibold transition-all duration-200 select-none bg-scan text-canvas hover:bg-scan-bright shadow-[0_0_0_1px_rgba(43,212,232,0.35)] hover:shadow-[0_10px_34px_-10px_rgba(116,236,246,0.55)] mt-4 w-full">Check my repo</a></div><div class="rounded-2xl border border-line bg-surface p-5 font-mono text-xs"><span class="text-ink-faint">Summarize with</span><div class="mt-2 flex flex-wrap gap-3"><a href="https://chatgpt.com/?q=Summarize%20CVE-2026-61823%20from%20https%3A%2F%2Fstateward.com%2Fvulnerabilities%2FCVE-2026-61823" rel="nofollow noopener" class="text-scan hover:underline">ChatGPT</a><a href="https://claude.ai/new?q=Summarize%20CVE-2026-61823%20from%20https%3A%2F%2Fstateward.com%2Fvulnerabilities%2FCVE-2026-61823" rel="nofollow noopener" class="text-scan hover:underline">Claude</a><a href="https://www.perplexity.ai/search?q=Summarize%20CVE-2026-61823%20from%20https%3A%2F%2Fstateward.com%2Fvulnerabilities%2FCVE-2026-61823" rel="nofollow noopener" class="text-scan hover:underline">Perplexity</a></div></div></aside></div></div></section><section class="relative px-6 md:px-10 pb-20"><div class="mx-auto w-full max-w-6xl"><div class="flex items-baseline justify-between gap-3"><h2 class="font-mono text-xs uppercase tracking-wider text-ink-faint">Related vulnerabilities</h2><a href="/supply-chain" class="font-mono text-xs text-scan hover:underline">All Supply chain →</a></div><ul class="mt-4 grid gap-3 sm:grid-cols-2"><li class="card-hover rounded-xl border border-line bg-surface"><a href="/vulnerabilities/CVE-2026-102989" class="block p-4"><div class="flex flex-wrap items-center gap-2"><span class="font-mono text-xs font-semibold" style="color:var(--color-critical)">CRITICAL</span><span class="font-mono text-sm text-ink">CVE-2026-102989</span></div><p class="mt-1.5 line-clamp-2 text-sm text-ink-soft">TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses</p></a></li><li class="card-hover rounded-xl border border-line bg-surface"><a href="/vulnerabilities/CVE-2026-104252" class="block p-4"><div class="flex flex-wrap items-center gap-2"><span class="font-mono text-xs font-semibold" style="color:var(--color-critical)">CRITICAL</span><span class="font-mono text-sm text-ink">CVE-2026-104252</span></div><p class="mt-1.5 line-clamp-2 text-sm text-ink-soft">Vitess vttablet /twopcz reflected XSS</p></a></li><li class="card-hover rounded-xl border border-line bg-surface"><a href="/vulnerabilities/CVE-2026-104250" class="block p-4"><div class="flex flex-wrap items-center gap-2"><span class="font-mono text-xs font-semibold" style="color:var(--color-scan)">MEDIUM</span><span class="font-mono text-sm text-ink">CVE-2026-104250</span></div><p class="mt-1.5 line-clamp-2 text-sm text-ink-soft">unstructured: Stored XSS via unescaped HTML generation</p></a></li><li class="card-hover rounded-xl border border-line bg-surface"><a href="/vulnerabilities/CVE-2026-96230" class="block p-4"><div class="flex flex-wrap items-center gap-2"><span class="font-mono text-xs font-semibold" style="color:var(--color-high)">HIGH</span><span class="font-mono text-sm text-ink">CVE-2026-96230</span></div><p class="mt-1.5 line-clamp-2 text-sm text-ink-soft">Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability</p></a></li><li class="card-hover rounded-xl border border-line bg-surface"><a href="/vulnerabilities/CVE-2026-108260" class="block p-4"><div class="flex flex-wrap items-center gap-2"><span class="font-mono text-xs font-semibold" style="color:var(--color-high)">HIGH</span><span class="font-mono text-sm text-ink">CVE-2026-108260</span></div><p class="mt-1.5 line-clamp-2 text-sm text-ink-soft">@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS</p></a></li><li class="card-hover rounded-xl border border-line bg-surface"><a href="/vulnerabilities/CVE-2026-107845" class="block p-4"><div class="flex flex-wrap items-center gap-2"><span class="font-mono text-xs font-semibold" style="color:var(--color-critical)">CRITICAL</span><span class="font-mono text-sm text-ink">CVE-2026-107845</span></div><p class="mt-1.5 line-clamp-2 text-sm text-ink-soft">Contao: Cross-site scripting in the comments bundle</p></a></li></ul></div></section></main><footer class="mt-32 border-t border-line/60"><div class="mx-auto grid w-full max-w-6xl gap-12 px-6 py-16 md:grid-cols-2 lg:grid-cols-[1.5fr_repeat(5,1fr)] md:px-10"><div class="max-w-xs"><a class="flex items-center gap-2.5" href="/"><svg class="h-8 w-8" viewBox="0 0 48 48" fill="none" role="img" aria-label="Stateward" xmlns="http://www.w3.org/2000/svg"><title>Stateward</title><defs><linearGradient id="sw_c" x1="10" y1="44" x2="38" y2="4" gradientUnits="userSpaceOnUse"><stop stop-color="#1592a6"></stop><stop offset="0.5" stop-color="#2bd4e8"></stop><stop offset="1" stop-color="#74ecf6"></stop></linearGradient><linearGradient id="sw_f" x1="8" y1="44" x2="40" y2="4" gradientUnits="userSpaceOnUse"><stop stop-color="#2bd4e8" stop-opacity="0.16"></stop><stop offset="1" stop-color="#2bd4e8" stop-opacity="0.04"></stop></linearGradient></defs><path d="M24 4 L40 9 V23 C40 32 33 39 24 43 C15 39 8 32 8 23 V9 Z" fill="url(#sw_f)" stroke="url(#sw_c)" stroke-width="2" stroke-linejoin="round"></path><path d="M21 17 L14 24 L21 31" stroke="url(#sw_c)" stroke-width="2.8" stroke-linecap="round" stroke-linejoin="round"></path><path d="M27 17 L34 24 L27 31" stroke="url(#sw_c)" stroke-width="2.8" stroke-linecap="round" stroke-linejoin="round"></path></svg><span class="text-lg font-semibold tracking-tight">Stateward</span></a><p class="mt-4 text-sm text-ink-soft">Autonomous cybersecurity for your entire codebase.</p><a href="https://yggdrasil.digital" target="_blank" rel="noopener noreferrer" class="mt-4 inline-block font-mono text-xs text-ink-faint hover:text-scan">A venture of Yggdrasil Digital.</a></div><div><h3 class="font-mono text-xs uppercase tracking-wider text-ink-faint">Product</h3><ul class="mt-4 space-y-3 text-sm"><li><a class="text-ink-soft hover:text-scan" href="/platform">Platform</a></li><li><a class="text-ink-soft hover:text-scan" href="/coverage">What we detect</a></li><li><a class="text-ink-soft hover:text-scan" href="/protect">How we protect you</a></li><li><a class="text-ink-soft hover:text-scan" href="/pricing">Pricing</a></li><li><a class="text-ink-soft hover:text-scan" href="/compliance">Compliance</a></li><li><a class="text-ink-soft hover:text-scan" href="/vulnerabilities">Vulnerabilities</a></li><li><a class="text-ink-soft hover:text-scan" href="/blog">Blog</a></li><li><a class="text-ink-soft hover:text-scan" href="/contact">Get started free</a></li></ul></div><div><h3 class="font-mono text-xs uppercase tracking-wider text-ink-faint">Resources</h3><ul class="mt-4 space-y-3 text-sm"><li><a class="text-ink-soft hover:text-scan" href="/incidents">Breach breakdowns</a></li><li><a class="text-ink-soft hover:text-scan" href="/merge-induced-vulnerabilities">Merge-induced flaws</a></li><li><a class="text-ink-soft hover:text-scan" href="/docs">Docs</a></li><li><a class="text-ink-soft hover:text-scan" href="/example">Sample finding</a></li><li><a class="text-ink-soft hover:text-scan" href="/glossary">Glossary</a></li><li><a class="text-ink-soft hover:text-scan" href="/compare/snyk">Compare</a></li><li><a class="text-ink-soft hover:text-scan" href="/threats.json">Threat feed API ↗</a></li></ul></div><div><h3 class="font-mono text-xs uppercase tracking-wider text-ink-faint">Company</h3><ul class="mt-4 space-y-3 text-sm"><li><a class="text-ink-soft hover:text-scan" href="/about">About</a></li><li><a class="text-ink-soft hover:text-scan" href="https://yggdrasil.digital" target="_blank" rel="noopener noreferrer">Yggdrasil Digital ↗</a></li></ul></div><div><h3 class="font-mono text-xs uppercase tracking-wider text-ink-faint">Legal</h3><ul class="mt-4 space-y-3 text-sm"><li><a class="text-ink-soft hover:text-scan" href="/legal/notice">Legal notice</a></li><li><a class="text-ink-soft hover:text-scan" href="/legal/terms">Terms of Use</a></li><li><a class="text-ink-soft hover:text-scan" href="/legal/sales">Terms of Sale</a></li><li><a class="text-ink-soft hover:text-scan" href="/legal/privacy">Privacy</a></li><li><a class="text-ink-soft hover:text-scan" href="/legal/cookies">Cookies</a></li><li><a class="text-ink-soft hover:text-scan" href="/legal/dpa">DPA</a></li></ul></div><div><h3 class="font-mono text-xs uppercase tracking-wider text-ink-faint">Connect</h3><ul class="mt-4 space-y-3 text-sm"><li><a class="text-ink-soft hover:text-scan" href="https://github.com/stateward" target="_blank" rel="noopener noreferrer">GitHub ↗</a></li><li><a class="text-ink-soft hover:text-scan" href="https://x.com/stateward" target="_blank" rel="noopener noreferrer">X ↗</a></li><li><a class="text-ink-soft hover:text-scan" href="https://yggdrasil.digital" target="_blank" rel="noopener noreferrer">Yggdrasil Digital ↗</a></li><li><a class="text-ink-soft hover:text-scan" href="/feed.xml">Threat feed (RSS) ↗</a></li><li><a class="text-ink-soft hover:text-scan" href="mailto:hello@stateward.com">hello@stateward.com</a></li></ul></div></div><div class="border-t border-line/60"><div class="mx-auto w-full max-w-6xl px-6 py-6 md:px-10"><p class="text-xs leading-relaxed text-ink-faint">Stateward provides automated security analysis and does not guarantee detection of all vulnerabilities. It is designed to support, not replace, sound security practices and human judgement.</p></div></div><div class="border-t border-line/60"><div class="mx-auto flex w-full max-w-6xl flex-col items-center justify-between gap-2 px-6 py-6 font-mono text-xs text-ink-faint md:flex-row md:px-10"><span>© 2026 Stateward. All rights reserved.</span><span>A Yggdrasil Digital venture</span></div></div></footer></div><script>window.__staticRouterHydrationData = JSON.parse("{\"loaderData\":{\"0\":null,\"0-748\":null},\"actionData\":null,\"errors\":null}");</script></div> <script>window.__VITE_REACT_SSG_HASH__ = 'b4cuvzwf4v'</script> </body> </html>