CVE-2026-61825: code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

September 25, 2026

The vulnerability allows an attacker to bypass the HTML sanitizer by using the data-html-content attribute in the content of a SharpEditorFormField.

References

github.com/advisories/GHSA-vj3q-vp3g-j9c8
github.com/code16/sharp/commit/ec509a22c808a5bd9dfad6a0a85c92ce6f411e21
github.com/code16/sharp/security/advisories/GHSA-vj3q-vp3g-j9c8
nvd.nist.gov/vuln/detail/CVE-2026-61825

Code Behaviors & Features

Detect and mitigate CVE-2026-61825 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →