CVE-2026-61823High· 7.3▾ Twilightcode16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in the rich-text editor because the HTML sanitizer permit…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in the rich-text editor because the HTML sanitizer permits the srcdoc attribute on iframe elements. Although markup inside srcdoc is HTML-encoded during sanitization, browsers decode attribute entities before interpreting the iframe document, allowing an authenticated user with permission to edit an Editor field to store executable JavaScript that runs when another user views the content. Successful exploitation can result in session hijacking, unauthorized actions, account takeover, privilege escalation, or disclosure of administrative data. Version 9.22.5 patches the vulnerability by removing srcdoc from the permitted iframe attributes. As a workaround, applications that cannot upgrade should manually sanitize all Editor field content and remove every iframe srcdoc attribute before storing or rendering it.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
code16/sharp < 9.22.5Patched in:
code16/sharp 9.22.5Connected by shared product, vendor, weakness, or advisory.
CVE-2026-61825High· 8.7code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces
CVE-2026-114112High· 8.9Sharp before 0.35.4 RCE via bundled libheif AVIF decoding
CVE-2026-114111High· 8.9Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerability
CVE-2026-114113High· 8.4Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decoders
GHSA-wq5f-xc86-pv6wHighsharp : Vulnerability in librsvg dependency CVE-2026-96889
GHSA-rgj7-g3m4-5g8cHighsharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545