GHSA-vj3q-vp3g-j9c8: XSS
Impact The vulnerability allows an attacker to bypass the HTML sanitizer by using the data-html-content attribute in the content of a SharpEditorFormField.
Patches The field must now explicitly configure SharpFormEditorField::RAWHTML in the toolbar to keep this behavior. When using the RAWHTML button, the application using code16/sharp must sanitize manually the content coming from the field. Vulnerability has been patched in version 9.22.5.
Workarounds Sanitize every contents of editors manually (e.g. using Symfony/HtmlSanitizer)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/code16/sharpto a version that resolves this vulnerability.Fixed in 9.22.5 - Upgrade
Upgrade
code16/sharpto a version that resolves this vulnerability.Fixed in 9.22.5 - Configuration
Explicitly configure SharpFormEditorField::RAW_HTML in the toolbar to retain this behavior.
SharpFormEditorField toolbar = RAW_HTML - Compensating control
When using the RAW_HTML button, manually sanitize all content coming from the field, including every editor's contents, using Symfony/HtmlSanitizer.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using code16/sharp that render content from SharpEditorFormField are exposed if untrusted users can submit or influence editor content. The issue can lead to cross-site scripting when malicious HTML bypasses the field's sanitizer.
What does an attacker need to exploit it?
An attacker needs low-privileged access and user interaction, as indicated by the provided CVSS vector. They would need to place a payload using the data-html-content attribute in SharpEditorFormField content and have it rendered to a victim.
Are patched versions affected by default?
Version 9.22.5 contains the patch. After the change, retaining raw HTML behavior requires explicitly configuring SharpFormEditorField::RAW_HTML in the toolbar; applications that enable it must manually sanitize field content.
What can be done if upgrading is not immediately possible?
Manually sanitize all editor content before rendering or storing it, for example with Symfony/HtmlSanitizer. This is the documented workaround for installations that cannot immediately apply the patch.