Executive brief
code16 Sharp is a rich text editor used in content management applications. An attacker with permissions to edit content can inject malicious scripts via the srcdoc attribute in iframe elements. When other users view the affected content, the scripts execute with the viewer's privileges, enabling account takeover, session hijacking, and theft of admin panel data.
Technical details
A stored XSS vulnerability exists in the rich text editor's sanitization of iframe elements. Although the underlying Symfony HtmlSanitizer HTML-encodes special characters in attribute values, the HTML specification requires browsers to automatically decode HTML entities within attributes before processing. As a result, encoded JavaScript in the srcdoc attribute is decoded and executed as live HTML/JS within the iframe context. An attacker with Editor field edit permissions can inject malicious payloads that execute when other users render the content. The vulnerability has been patched in version 9.22.5 by explicitly removing srcdoc from the list of allowed iframe attributes in FormatsSanitizedValue.php.
Affected products
- code16 Sharp < 9.22.5
Timeline
- 2026-06-24: disclosed
- 2026-09-25: patched: Version 9.22.5 released