Is code16/sharp affected by CVE-2026-61823?

Packagist code16/sharp is affected in < 9.22.5.

Is CVE-2026-61823 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.2%.

← Toutes les vulnérabilités

HIGHSupply chain

CVE-2026-61823

Q: Is CVE-2026-61823 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.2%.

Packagist · code16/sharp

Résumé

code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

Détails de l’avis

Impact

A Stored Cross-Site Scripting (XSS) vulnerability exists in the rich text editor due to improper sanitization of the srcdoc attribute on elements.</p> <p>While the underlying Symfony HtmlSanitizer correctly HTML-encodes special characters inside the attribute value (e.g., converting <script> to <script>), the HTML specification mandates that browsers automatically decode HTML entities inside attribute values before processing them. As a result, any encoded JavaScript inside a srcdoc attribute is evaluated and executed as live HTML/JS in the context of the iframe when the page is rendered.</p> <p>An attacker with permissions to edit an Editor field can inject malicious scripts to target other users viewing the content. Potential impacts include:</p> <ul> <li>Session Hijacking (stealing admin session cookies via document.cookie)</li> <li>Account Takeover & Privilege Escalation (e.g., a low-privileged editor triggering actions as an Administrator)</li> <li>Admin panel data theft</li> </ul> <h3>Patches</h3> <p>The vulnerability has been patched in version v9.22.5.</p> <p>The fix explicitly removes srcdoc from the list of allowed iframe attributes in <code>src/Utils/Sanitization/FormatsSanitizedValue.php</code>.</p> <h3>Workarounds</h3> <p>Users who cannot upgrade immediately can manually sanitize all content of editor fields to strip <code>srcdoc</code> attributes.</p> </div><h2 class="mt-8 font-mono text-xs uppercase tracking-wider text-ink-faint">Références</h2><ul class="mt-3 space-y-1"><li><a href="https://github.com/advisories/GHSA-qxg3-46rw-79j8" target="_blank" rel="noopener noreferrer" class="break-all text-sm text-scan hover:underline">https://github.com/advisories/GHSA-qxg3-46rw-79j8</a></li><li><a href="https://github.com/code16/sharp/security/advisories/GHSA-qxg3-46rw-79j8" target="_blank" rel="noopener noreferrer" class="break-all text-sm text-scan hover:underline">https://github.com/code16/sharp/security/advisories/GHSA-qxg3-46rw-79j8</a></li><li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-61823" target="_blank" rel="noopener noreferrer" class="break-all text-sm text-scan hover:underline">https://nvd.nist.gov/vuln/detail/CVE-2026-61823</a></li><li><a href="https://github.com/code16/sharp/commit/ec509a22c808a5bd9dfad6a0a85c92ce6f411e21" target="_blank" rel="noopener noreferrer" class="break-all text-sm text-scan hover:underline">https://github.com/code16/sharp/commit/ec509a22c808a5bd9dfad6a0a85c92ce6f411e21</a></li></ul></div><aside class="space-y-4"><div class="rounded-2xl border border-line bg-surface p-5 font-mono text-sm"><div class="flex justify-between gap-3 border-b border-line py-1.5 last:border-0"><span class="text-ink-faint">Source</span><span class="text-right text-ink">Stateward</span></div><div class="flex justify-between gap-3 border-b border-line py-1.5 last:border-0"><span class="text-ink-faint">Severity</span><span class="text-right text-ink">high</span></div><div class="flex justify-between gap-3 border-b border-line py-1.5 last:border-0"><span class="text-ink-faint">CVSS</span><span class="text-right text-ink">7.3</span></div><div class="flex justify-between gap-3 border-b border-line py-1.5 last:border-0"><span class="text-ink-faint">EPSS</span><span class="text-right text-ink">0.2% (p11)</span></div><div class="flex justify-between gap-3 border-b border-line py-1.5 last:border-0"><span class="text-ink-faint">Also known as</span><span class="text-right text-ink">GHSA-qxg3-46rw-79j8</span></div><div class="flex justify-between gap-3 border-b border-line py-1.5"><span class="text-ink-faint">CWE</span><span class="text-right"><span><a href="/cwe/79" class="text-scan hover:underline">CWE-79</a></span></span></div><div class="flex justify-between gap-3 border-b border-line py-1.5 last:border-0"><span class="text-ink-faint">Added</span><span class="text-right text-ink">2026-09-25</span></div></div><div class="rounded-2xl border border-scan/30 bg-scan/5 p-5"><p class="text-sm text-ink">Votre projet est-il exposé ? Stateward vérifie chaque dépendance à chaque pull request, et ne la signale que si votre code l’atteint réellement.</p><a href="https://app.stateward.com" target="_blank" rel="noopener noreferrer" class="inline-flex items-center justify-center gap-2 rounded-lg px-6 py-3 text-sm font-semibold transition-all duration-200 select-none bg-scan text-canvas hover:bg-scan-bright shadow-[0_0_0_1px_rgba(43,212,232,0.35)] hover:shadow-[0_10px_34px_-10px_rgba(116,236,246,0.55)] mt-4 w-full">Vérifier mon dépôt</a></div><div class="rounded-2xl border border-line bg-surface p-5 font-mono text-xs"><span class="text-ink-faint">Résumer avec</span><div class="mt-2 flex flex-wrap gap-3"><a href="https://chatgpt.com/?q=Summarize%20CVE-2026-61823%20from%20https%3A%2F%2Fstateward.com%2Fvulnerabilities%2FCVE-2026-61823" rel="nofollow noopener" class="text-scan hover:underline">ChatGPT</a><a href="https://claude.ai/new?q=Summarize%20CVE-2026-61823%20from%20https%3A%2F%2Fstateward.com%2Fvulnerabilities%2FCVE-2026-61823" rel="nofollow noopener" class="text-scan hover:underline">Claude</a><a href="https://www.perplexity.ai/search?q=Summarize%20CVE-2026-61823%20from%20https%3A%2F%2Fstateward.com%2Fvulnerabilities%2FCVE-2026-61823" rel="nofollow noopener" class="text-scan hover:underline">Perplexity</a></div></div></aside></div></div></section><section class="relative px-6 md:px-10 pb-20"><div class="mx-auto w-full max-w-6xl"><div class="flex items-baseline justify-between gap-3"><h2 class="font-mono text-xs uppercase tracking-wider text-ink-faint">Vulnérabilités liées</h2><a href="/fr/supply-chain" class="font-mono text-xs text-scan hover:underline">Tout Supply chain →</a></div><ul class="mt-4 grid gap-3 sm:grid-cols-2"><li class="card-hover rounded-xl border border-line bg-surface"><a href="/fr/vulnerabilities/CVE-2026-102989" class="block p-4"><div class="flex flex-wrap items-center gap-2"><span class="font-mono text-xs font-semibold" style="color:var(--color-critical)">CRITICAL</span><span class="font-mono text-sm text-ink">CVE-2026-102989</span></div><p class="mt-1.5 line-clamp-2 text-sm text-ink-soft">TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses</p></a></li><li class="card-hover rounded-xl border border-line bg-surface"><a href="/fr/vulnerabilities/CVE-2026-104252" class="block p-4"><div class="flex flex-wrap items-center gap-2"><span class="font-mono text-xs font-semibold" style="color:var(--color-critical)">CRITICAL</span><span class="font-mono text-sm text-ink">CVE-2026-104252</span></div><p class="mt-1.5 line-clamp-2 text-sm text-ink-soft">Vitess vttablet /twopcz reflected XSS</p></a></li><li class="card-hover rounded-xl border border-line bg-surface"><a href="/fr/vulnerabilities/CVE-2026-104250" class="block p-4"><div class="flex flex-wrap items-center gap-2"><span class="font-mono text-xs font-semibold" style="color:var(--color-scan)">MEDIUM</span><span class="font-mono text-sm text-ink">CVE-2026-104250</span></div><p class="mt-1.5 line-clamp-2 text-sm text-ink-soft">unstructured: Stored XSS via unescaped HTML generation</p></a></li><li class="card-hover rounded-xl border border-line bg-surface"><a href="/fr/vulnerabilities/CVE-2026-96230" class="block p-4"><div class="flex flex-wrap items-center gap-2"><span class="font-mono text-xs font-semibold" style="color:var(--color-high)">HIGH</span><span class="font-mono text-sm text-ink">CVE-2026-96230</span></div><p class="mt-1.5 line-clamp-2 text-sm text-ink-soft">Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability</p></a></li><li class="card-hover rounded-xl border border-line bg-surface"><a href="/fr/vulnerabilities/CVE-2026-108260" class="block p-4"><div class="flex flex-wrap items-center gap-2"><span class="font-mono text-xs font-semibold" style="color:var(--color-high)">HIGH</span><span class="font-mono text-sm text-ink">CVE-2026-108260</span></div><p class="mt-1.5 line-clamp-2 text-sm text-ink-soft">@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS</p></a></li><li class="card-hover rounded-xl border border-line bg-surface"><a href="/fr/vulnerabilities/CVE-2026-107845" class="block p-4"><div class="flex flex-wrap items-center gap-2"><span class="font-mono text-xs font-semibold" style="color:var(--color-critical)">CRITICAL</span><span class="font-mono text-sm text-ink">CVE-2026-107845</span></div><p class="mt-1.5 line-clamp-2 text-sm text-ink-soft">Contao: Cross-site scripting in the comments bundle</p></a></li></ul></div></section></main><footer class="mt-32 border-t border-line/60"><div class="mx-auto grid w-full max-w-6xl gap-12 px-6 py-16 md:grid-cols-2 lg:grid-cols-[1.5fr_repeat(5,1fr)] md:px-10"><div class="max-w-xs"><a class="flex items-center gap-2.5" href="/fr"><svg class="h-8 w-8" viewBox="0 0 48 48" fill="none" role="img" aria-label="Stateward" xmlns="http://www.w3.org/2000/svg"><title>Stateward</title><defs><linearGradient id="sw_c" x1="10" y1="44" x2="38" y2="4" gradientUnits="userSpaceOnUse"><stop stop-color="#1592a6"></stop><stop offset="0.5" stop-color="#2bd4e8"></stop><stop offset="1" stop-color="#74ecf6"></stop></linearGradient><linearGradient id="sw_f" x1="8" y1="44" x2="40" y2="4" gradientUnits="userSpaceOnUse"><stop stop-color="#2bd4e8" stop-opacity="0.16"></stop><stop offset="1" stop-color="#2bd4e8" stop-opacity="0.04"></stop></linearGradient></defs><path d="M24 4 L40 9 V23 C40 32 33 39 24 43 C15 39 8 32 8 23 V9 Z" fill="url(#sw_f)" stroke="url(#sw_c)" stroke-width="2" stroke-linejoin="round"></path><path d="M21 17 L14 24 L21 31" stroke="url(#sw_c)" stroke-width="2.8" stroke-linecap="round" stroke-linejoin="round"></path><path d="M27 17 L34 24 L27 31" stroke="url(#sw_c)" stroke-width="2.8" stroke-linecap="round" stroke-linejoin="round"></path></svg><span class="text-lg font-semibold tracking-tight">Stateward</span></a><p class="mt-4 text-sm text-ink-soft">Cybersécurité autonome pour tout votre code.</p><a href="https://yggdrasil.digital" target="_blank" rel="noopener noreferrer" class="mt-4 inline-block font-mono text-xs text-ink-faint hover:text-scan">Une initiative de Yggdrasil Digital.</a></div><div><h3 class="font-mono text-xs uppercase tracking-wider text-ink-faint">Produit</h3><ul class="mt-4 space-y-3 text-sm"><li><a class="text-ink-soft hover:text-scan" href="/fr/platform">Plateforme</a></li><li><a class="text-ink-soft hover:text-scan" href="/fr/coverage">Ce que nous détectons</a></li><li><a class="text-ink-soft hover:text-scan" href="/fr/protect">Comment nous protégeons</a></li><li><a class="text-ink-soft hover:text-scan" href="/fr/pricing">Tarifs</a></li><li><a class="text-ink-soft hover:text-scan" href="/fr/compliance">Conformité</a></li><li><a class="text-ink-soft hover:text-scan" href="/fr/vulnerabilities">Vulnérabilités</a></li><li><a class="text-ink-soft hover:text-scan" href="/fr/blog">Blog</a></li><li><a class="text-ink-soft hover:text-scan" href="/fr/contact">Commencer gratuitement</a></li></ul></div><div><h3 class="font-mono text-xs uppercase tracking-wider text-ink-faint">Ressources</h3><ul class="mt-4 space-y-3 text-sm"><li><a class="text-ink-soft hover:text-scan" href="/fr/incidents">Analyses d’incidents</a></li><li><a class="text-ink-soft hover:text-scan" href="/fr/merge-induced-vulnerabilities">Failles de fusion</a></li><li><a class="text-ink-soft hover:text-scan" href="/fr/docs">Docs</a></li><li><a class="text-ink-soft hover:text-scan" href="/fr/example">Exemple concret</a></li><li><a class="text-ink-soft hover:text-scan" href="/fr/glossary">Glossaire</a></li><li><a class="text-ink-soft hover:text-scan" href="/fr/compare/snyk">Comparatifs</a></li><li><a class="text-ink-soft hover:text-scan" href="/threats.json">API du flux ↗</a></li></ul></div><div><h3 class="font-mono text-xs uppercase tracking-wider text-ink-faint">Société</h3><ul class="mt-4 space-y-3 text-sm"><li><a class="text-ink-soft hover:text-scan" href="/fr/about">À propos</a></li><li><a class="text-ink-soft hover:text-scan" href="https://yggdrasil.digital" target="_blank" rel="noopener noreferrer">Yggdrasil Digital ↗</a></li></ul></div><div><h3 class="font-mono text-xs uppercase tracking-wider text-ink-faint">Légal</h3><ul class="mt-4 space-y-3 text-sm"><li><a class="text-ink-soft hover:text-scan" href="/fr/legal/notice">Mentions légales</a></li><li><a class="text-ink-soft hover:text-scan" href="/fr/legal/terms">CGU</a></li><li><a class="text-ink-soft hover:text-scan" href="/fr/legal/sales">CGV</a></li><li><a class="text-ink-soft hover:text-scan" href="/fr/legal/privacy">Confidentialité</a></li><li><a class="text-ink-soft hover:text-scan" href="/fr/legal/cookies">Cookies</a></li><li><a class="text-ink-soft hover:text-scan" href="/fr/legal/dpa">DPA</a></li></ul></div><div><h3 class="font-mono text-xs uppercase tracking-wider text-ink-faint">Suivre</h3><ul class="mt-4 space-y-3 text-sm"><li><a class="text-ink-soft hover:text-scan" href="https://github.com/stateward" target="_blank" rel="noopener noreferrer">GitHub ↗</a></li><li><a class="text-ink-soft hover:text-scan" href="https://x.com/stateward" target="_blank" rel="noopener noreferrer">X ↗</a></li><li><a class="text-ink-soft hover:text-scan" href="https://yggdrasil.digital" target="_blank" rel="noopener noreferrer">Yggdrasil Digital ↗</a></li><li><a class="text-ink-soft hover:text-scan" href="/feed.xml">Flux de menaces (RSS) ↗</a></li><li><a class="text-ink-soft hover:text-scan" href="mailto:hello@stateward.com">hello@stateward.com</a></li></ul></div></div><div class="border-t border-line/60"><div class="mx-auto w-full max-w-6xl px-6 py-6 md:px-10"><p class="text-xs leading-relaxed text-ink-faint">Stateward fournit une analyse de sécurité automatisée et ne garantit pas la détection de toutes les vulnérabilités. Il est conçu pour appuyer, et non remplacer, de bonnes pratiques de sécurité et le jugement humain.</p></div></div><div class="border-t border-line/60"><div class="mx-auto flex w-full max-w-6xl flex-col items-center justify-between gap-2 px-6 py-6 font-mono text-xs text-ink-faint md:flex-row md:px-10"><span>© 2026 Stateward. Tous droits réservés.</span><span>Une initiative Yggdrasil Digital</span></div></div></footer></div><script>window.__staticRouterHydrationData = JSON.parse("{\"loaderData\":{\"1\":null,\"1-748\":null},\"actionData\":null,\"errors\":null}");</script></div> <script>window.__VITE_REACT_SSG_HASH__ = 'b4cuvzwf4v'</script> </body> </html>