code16/sharp has a stored XSS via data-html-content Sanitizer Bypass (CVE-2026-61825)

Package: code16/sharp
Fixed in: 9.22.5
Published: Fri 25 Sep 2026, 16:00 LisbonUpdated Mon 26 Oct 2026, 01:25 Lisbon
Installs on Packagist: 69K

In plain words

An attacker can bypass the HTML sanitiser using the data-html-content attribute in content from a SharpEditorFormField, allowing stored cross-site scripting. The flaw affects code16/sharp versions below 9.22.5 and is fixed in 9.22.5. In the patched version, retaining this behaviour requires explicitly adding SharpFormEditorField::RAW_HTML to the toolbar, and applications using that button must sanitise the field content manually.

Affected versions

Package	Affected	Fixed in
code16/sharp	< 9.22.5	9.22.5

Am I affected?

Check composer.lock for code16/sharp and its version. If it is below 9.22.5, check whether your application uses SharpEditorFormField for editor content. If using the patched version, check whether the toolbar includes SharpFormEditorField::RAW_HTML; if so, ensure content from that field is sanitised manually.

What to do

Check which version you have, then update to a fixed release for your branch (9.22.5):

composer show code16/sharp | grep versions
composer update code16/sharp

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

Sanitise all editor content manually, for example using Symfony/HtmlSanitizer.

The advisory's description

Impact

The vulnerability allows an attacker to bypass the HTML sanitizer by using the data-html-content attribute in the content of a SharpEditorFormField.

Patches

The field must now explicitly configure SharpFormEditorField::RAW_HTML in the toolbar to keep this behavior. When using the RAW_HTML button, the application using code16/sharp must sanitize manually the content coming from the field. Vulnerability has been patched in version 9.22.5.

Workarounds

Sanitize every contents of editors manually (e.g. using Symfony/HtmlSanitizer)

Weakness: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Reported by nova-aryan.

The advisory

GitHub Advisory Database: GHSA-vj3q-vp3g-j9c8, with who is affected and how
OSV.dev: GHSA-vj3q-vp3g-j9c8
The week's digest, with the other advisories from 21 Sep 2026
All advisories for code16/sharp

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description, affected versions, weakness and credits are from the GitHub Advisory Database (CC BY 4.0). "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.