PkgSeer

Vulnerability GHSA-vj3q-vp3g-j9c8

High Risk

2 days ago

code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

4.0-BETA1 - 6.5.5 and 7.0.0-beta.1 - 9.22.4

Summary

code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

Details

Impact

The vulnerability allows an attacker to bypass the HTML sanitizer by using the data-html-content attribute in the content of a SharpEditorFormField.

Patches

The field must now explicitly configure SharpFormEditorField::RAW_HTML in the toolbar to keep this behavior. When using the RAW_HTML button, the application using code16/sharp must sanitize manually the content coming from the field. Vulnerability has been patched in version 9.22.5.

Workarounds

Sanitize every contents of editors manually (e.g. using Symfony/HtmlSanitizer)

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

4.0-BETA1 - 6.5.5 and 7.0.0-beta.1 - 9.22.4 GHSA-qxg3-46rw-79j8

Sharp Missing Authorization Check in Quick Creation Command Endpoints

9.0.0 - 9.22.2 GHSA-vmwx-m75v-qvch

Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint

4.0-BETA1 - 6.5.5 and 7.0.0-beta.1 - 9.21.2 GHSA-748w-hm6r-qc7v

Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil

4.0-BETA1 - 6.5.5 and 7.0.0-beta.1 - 9.19.3 GHSA-9ffq-6457-8958

Sharp has Unrestricted File Upload via Client-Controlled Validation Rules

4.0-BETA1 - 6.5.5 and 7.0.0-beta.1 - 9.19.3 GHSA-fr76-5637-w3g9

View all vulnerabilities for these packages

Impacted packages

code16/sharp

Timeline

Published

2 days ago

Fixed (9.22.5)

3 months ago

Last Modified

2 days ago