PKSA-tzfc-wx9k-qbx7: code16/sharp: Arbitrary class instantiation through the embed_key API parameter
Published Nov 12, 2026
·Updated
code16/sharp: Arbitrary class instantiation through the embedkey API parameter
Affected Software
2 affected componentsFixes available
composer/code16/sharp>=10.0.0-beta.1, <10.0.0-beta.4
10.0.0-beta.4
composer/code16/sharp<9.23.0
9.23.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/code16/sharpto a version that resolves this vulnerability.Fixed in 10.0.0-beta.4 - Upgrade
Upgrade
composer/code16/sharpto a version that resolves this vulnerability.Fixed in 9.23.0
Event History
Nov 12, 2026
Advisory Published
via Packagist·06:18 PM
Data Sourced
via Packagist·06:18 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which dependency should be checked for exposure?
Check for the Composer package composer/code16/sharp.
2
What severity is assigned to this issue?
The issue is rated medium with a score of 4.