code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

High · CVSS 8.7

### Impact The vulnerability allows an attacker to bypass the HTML sanitizer by using the `data-html-content` attribute in the content of a `SharpEditorFormField`. ### Patches The field must now explicitly configure `SharpFormEditorField::RAW_HTML` in the toolbar to keep this behavior. **When using the `RAW_HTML` button, the application using `code16/sharp` must sanitize manually the content coming from the field**. Vulnerability has been patched in version 9.22.5. ### Workarounds Sanitize every contents of editors manually (e.g. using Symfony/HtmlSanitizer)

Remediation

Upgrade code16/sharp to 9.22.5 or later.

Affected PHP branches

See the source advisory.

Check your site

Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-vj3q-vp3g-j9c8

← All threats