code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

High · CVSS 7.3

### Impact A Stored Cross-Site Scripting (XSS) vulnerability exists in the rich text editor due to improper sanitization of the srcdoc attribute on <iframe> elements. While the underlying Symfony HtmlSanitizer correctly HTML-encodes special characters inside the attribute value (e.g., converting <script> to <script>), the HTML specification mandates that browsers automatically decode HTML entities inside attribute values before processing them.

Remediation

Upgrade code16/sharp to 9.22.5 or later.

Affected PHP branches

See the source advisory.

Check your site

Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-qxg3-46rw-79j8

← All threats