VDB
Sign up
HIGH8.7

GHSA-vj3q-vp3g-j9c8

code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

Quick fix

GHSA-vj3q-vp3g-j9c8 — code16/sharp: upgrade to the fixed version with the command below.

composer require code16/sharp:^9.22.5

Details

### Impact The vulnerability allows an attacker to bypass the HTML sanitizer by using the `data-html-content` attribute in the content of a `SharpEditorFormField`.

### Patches The field must now explicitly configure `SharpFormEditorField::RAW_HTML` in the toolbar to keep this behavior. **When using the `RAW_HTML` button, the application using `code16/sharp` must sanitize manually the content coming from the field**. Vulnerability has been patched in version 9.22.5.

### Workarounds Sanitize every contents of editors manually (e.g. using Symfony/HtmlSanitizer)

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/code16/sharp
Introduced in: 0Fixed in: 9.22.5
Fixcomposer require code16/sharp:^9.22.5

References