Two Stored XSS Vulnerabilities Patched in code16/Sharp Admin Framework

What Happened

Two stored XSS vulnerabilities were disclosed in code16/Sharp's `SharpEditorFormField` rich-text editor component. CVE-2026-61825 involves attacker-controlled content bearing a `data-html-content` attribute bypassing HTML sanitization, allowing executable markup to persist and run when another user views the stored content. CVE-2026-61823 involves the HTML sanitizer permitting the `srcdoc` attribute on iframe elements; although the markup inside `srcdoc` is HTML-encoded during sanitization, browsers decode attribute entities before interpreting the iframe document, which allows an authenticated user with Editor field permissions to store JavaScript that executes when another user views the content.

Technical Cause

Both vulnerabilities are classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). CVE-2026-61825 stems from a sanitizer bypass specific to the `data-html-content` attribute, which can preserve executable markup despite sanitization. CVE-2026-61823 stems from the sanitizer's allowlist permitting the `srcdoc` attribute on iframes; browsers decode HTML entities within that attribute before rendering it as a document, defeating the encoding-based mitigation.

Why It Matters

CVE-2026-61825 carries a CVSS score of 8.7, reflecting a scope-changed impact (the vulnerability can affect resources beyond the vulnerable component itself) with high confidentiality and integrity impact. CVE-2026-61823 carries a CVSS score of 7.3, also with high confidentiality and integrity impact, but without a scope change. The advisory for CVE-2026-61823 notes that successful exploitation could lead to session hijacking, unauthorized actions, account takeover, privilege escalation, or disclosure of administrative data when a victim with elevated access views the stored malicious content.

Who Is Affected

Any application using code16/sharp versions before 9.22.5 that relies on the rich-text editor's `SharpEditorFormField` component is affected. This includes applications that intentionally enable `SharpFormEditorField::RAW_HTML`, which the vendor notes must continue to sanitize editor content independently even after patching.

Affected Versions

code16/sharp versions prior to 9.22.5 are affected by both vulnerabilities. Version 9.22.5 contains the fix for both CVE-2026-61825 and CVE-2026-61823.

Fixes and Mitigation

The vendor has released version 9.22.5, which patches CVE-2026-61825 and, for CVE-2026-61823, removes `srcdoc` from the permitted iframe attributes. As workarounds for applications unable to upgrade immediately, the vendor recommends sanitizing all editor content before storing or rendering it (for example using Symfony HtmlSanitizer), disabling RAW_HTML functionality where not required, and manually removing any iframe `srcdoc` attributes from stored Editor field content.

Recommended Action

Site owners and developers using code16/sharp should update to version 9.22.5 as soon as possible. If immediate upgrading is not feasible, apply the documented workarounds: sanitize all rich-text editor content server-side, disable RAW_HTML where it is not strictly necessary, and strip iframe `srcdoc` attributes from stored content.