Is CVE-2026-84974 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84974 being exploited in the wild.

How severe is CVE-2026-84974?

Medium severity, with a CVSS score of 5.4, published 12 November 2026.

Which products and versions are affected?

Code16 Sharp = 10.0.0-beta.1 and < 10.0.0-beta.4; code16/sharp (Packagist) < 9.23.0.

Is there a fix for CVE-2026-84974?

Yes: fixed in 9.23.0, 10.0.0-beta.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-84974 attacked?

It is attacked over the network.

Am I affected by CVE-2026-84974?

Check whether you run Code16 Sharp or code16/sharp (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84974: Code16 Sharp arbitrary class instantiation in embed_key parameter

Q: Is there a fix for CVE-2026-84974?

Yes: fixed in 9.23.0, 10.0.0-beta.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-84974 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-84974?

Check whether you run Code16 Sharp or code16/sharp (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84974 · Severity: medium · CVSS 5.4 · Published 2026-11-12

Code16 Sharp is a PHP library for building data management interfaces in Laravel applications. An authenticated attacker can instantiate arbitrary classes by manipulating the embed_key API parameter, triggering unintended constructor execution that may cause application malfunction or expose sensitive information through dependency injection side effects.

Technologies: Code16 Sharp, code16/sharp (Packagist). Vendors: Code16, Packagist.

Quick answers

Is CVE-2026-84974 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84974 being exploited in the wild.
How severe is CVE-2026-84974?: Medium severity, with a CVSS score of 5.4, published 12 November 2026.
Which products and versions are affected?: Code16 Sharp < 9.23.0, >= 10.0.0-beta.1 and < 10.0.0-beta.4; code16/sharp (Packagist) < 9.23.0.
Is there a fix for CVE-2026-84974?: Yes: fixed in 9.23.0, 10.0.0-beta.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84974 attacked?: It is attacked over the network.
Am I affected by CVE-2026-84974?: Check whether you run Code16 Sharp or code16/sharp (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 9.23.0, 10.0.0-beta.4

Technical details

The vulnerability exists in Sharp's API endpoints that process the embed_key parameter without validating it is an instance of SharpFormEditorEmbed before passing it to Laravel's container for class instantiation. An authenticated attacker exploits this via CWE-470 (externally-controlled input selecting classes) to invoke the __construct() method of arbitrary classes with their resolved dependencies. The attacker cannot control parameter values or call additional methods, limiting impact to constructor side effects.

Affected products

Code16 Sharp < 9.23.0, >= 10.0.0-beta.1 and < 10.0.0-beta.4

Identifiers

CVE-2026-84974
GHSA-h24v-f482-8cwf

Timeline

2026-07-17: disclosed
2026-11-12: advisory

References

https://api.github.com/users/The4v1

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.