CVE-2026-61823: Stored Cross-Site Scripting (XSS) via iframe srcdoc Attribute in code16 Sharp

Vulnerability ID: CVE-2026-61823
CVSS Score: 7.3
Published: 2026-09-25

A stored cross-site scripting (XSS) vulnerability was identified in the content-management and administrative framework code16 Sharp. The flaw stems from an overly permissive HTML sanitization configuration that whitelists the 'srcdoc' attribute on HTML 'iframe' tags. When processed and stored, browsers render the content of this attribute by decoding nested HTML entities, converting sanitized elements back into executable code.

TL;DR

A stored cross-site scripting vulnerability in code16 Sharp allows authenticated users to inject arbitrary JavaScript via the 'srcdoc' attribute of an 'iframe' in rich-text fields. This bypasses backend sanitization because web browsers decode HTML entities within this attribute before execution.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-79
• Attack Vector: Network (N)
• CVSS Score: 7.3
• EPSS Score: 0.0021
• EPSS Percentile: 10.08%
• Exploit Status: poc
• KEV Status: Not Listed

Affected Systems

• code16/sharp
• sharp: < 9.22.5 (Fixed in: 9.22.5)

Code Analysis

Commit: ec509a2

Fix stored XSS by removing srcdoc attribute from allowed iframe attributes list

Mitigation Strategies

• Upgrade code16/sharp to version 9.22.5 or higher
• Deploy custom server-side middleware to sanitize or strip the srcdoc attribute from incoming HTML payloads
• Configure Content Security Policy (CSP) headers to restrict frame sources and script execution context

Remediation Steps:

1. Open the terminal in the application root directory.
2. Execute the command: composer update code16/sharp
3. Verify the installed version is 9.22.5 or higher in the composer.lock file.
4. Inspect custom rich-text configurations to ensure RAW_HTML properties are only granted to trusted administrative roles.

References

• GitHub Security Advisory GHSA-qxg3-46rw-79j8
• NVD CVE-2026-61823 Reference Record

Read the full report for CVE-2026-61823 on our website for more details including interactive diagrams and full exploit analysis.