Code16 Sharp versions prior to 9.22.5 are vulnerable to a stored cross-site scripting attack that enables malicious script execution within administrative interfaces.

This is a stored cross-site scripting (CWE-79) vulnerability occurring in the SharpEditorFormField component. An authenticated user can inject malicious markup using the data-html-content attribute, which bypasses existing sanitization mechanisms and executes when viewed by other users.

The exploitation of this vulnerability allows an attacker to execute arbitrary scripts in the context of other users, including administrators, which can lead to session hijacking, unauthorized data access, or perform actions on behalf of the victim. Given the CVSS score of 8.7, this represents a high-severity risk that could compromise the integrity and confidentiality of the content management system.

Immediate Action: Update the code16 Sharp framework to version 9.22.5 or later to resolve the sanitization bypass.

Proactive Monitoring: Review application access logs for unusual activity associated with administrative accounts, and audit stored content for suspicious script tags or obfuscated HTML attributes.

Compensating Controls: If an immediate update is not feasible, disable the RAW_HTML functionality in SharpFormEditorField and implement server-side sanitization libraries, such as the Symfony HtmlSanitizer, for all user-generated content before storage or rendering.

Public Exploit Available: No.

Organizations utilizing code16 Sharp should prioritize upgrading to version 9.22.5 immediately to eliminate this injection vector. Failure to patch allows attackers with lower-level access to escalate their impact by targeting administrative sessions, making timely remediation essential for maintaining the security of the management interface.