Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Sharp is a content management framework built for Laravel as a package. Prior to 9.11.1, a Cross-Site Scripting (XSS) vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component. In affected versions, expressions wrapped in {{ & }} were evaluated by Vue. This allowed attackers to inject arbitrary JavaScript or HTML that executes in the browser when the field is displayed. The issue has been fixed in v9.11.1 .
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| code16 | sharp | before 9.11.1 | 9.11.1 | Patch available | CNA |
| — | code16/sharp (Packagist) | before 9.11.1 | 9.11.1 | Patch available | GHSA-9f58-4465-23c7 |
- sharp Vendorcode16 Affected before 9.11.1 Fixed in 9.11.1 Patch available CNA
- code16/sharp (Packagist) Vendor— Affected before 9.11.1 Fixed in 9.11.1 Patch available GHSA-9f58-4465-23c7
Remediation
- Fix · CNA sharp (code16) Fixed in 9.11.1
- Fix · GHSA-9f58-4465-23c7 code16/sharp (Packagist) Fixed in 9.11.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-62798
- 2026-10-03 Alias added: GHSA-9f58-4465-23c7
References
Other 6
- https://github.com/code16/sharp/security/advisories/GHSA-9f58-4465-23c7
- https://github.com/code16/sharp/pull/654
- https://github.com/code16/sharp/releases/tag/v9.11.1
- https://github.com/ViktorMares/vue-js-xss-payload-list
- https://github.com/code16/sharp
- https://medium.com/@sid0krypt/vue-js-reflected-xss-fae04c9872d2
More code16 vulnerabilities
- TI-2026-26067 Sharp has Unrestricted File Upload via Client-Controlled Validation Rules CVSS 3.1HIGH 8.8
- TI-2026-26066 Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil CVSS 3.1HIGH 8.8
- TI-2026-44250 code16/sharp has a stored XSS via data-html-content Sanitizer Bypass CVSS 3.1HIGH 8.7
- TI-2026-44248 code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute CVSS 3.1HIGH 7.3
- TI-2026-32583 Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint CVSS 3.1HIGH 7.7
- TI-2026-38678 Sharp: Missing Authorization Check in Quick Creation Command Endpoints CVSS 3.1MEDIUM 4.3
Sources
- CVE-2025-62798 · CVE Program
- CVE-2025-62798 · NVD
- FIRST EPSS
- GHSA-9f58-4465-23c7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences