GIVE YOUR AGENT THE EVIDENCE

Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

GIVE YOUR AGENT THE EVIDENCE

Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

cve.new
Check your stack
GHSA-9f58-4465-23c7medium5.4

Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax

Impact

A Cross-Site Scripting (XSS) vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component.

Source excerpt · OSV

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

code16/sharp Packagist
Affected rangeRecorded fix
Earlier releases before 9.11.1Ecosystem versions9.11.1

Version evidence: OSV · GHSA-9f58-4465-23c7

View original version evidence (290 explicit versions)

Original source description

A Cross-Site Scripting (XSS) vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component.

In affected versions, expressions wrapped in {{ & }} were evaluated by Vue. This allowed attackers to inject arbitrary JavaScript or HTML that executes in the browser when the field is displayed.

For example, if a field’s value contains {{ Math.random() }}, it will be executed instead of being displayed as text.

Impact

Attackers who can control content rendered through SharpShowTextField could execute arbitrary JavaScript in the context of an authenticated user’s browser.

This could lead to:

  • Theft of user session tokens.
  • Unauthorized actions performed on behalf of users.
  • Injection of malicious content into the admin panel.

Patches

The issue has been fixed in v9.11.1 of code16/sharp package.

Mitigation / Workarounds

Sanitize or encode any user-provided data that may include ({{ & }}) before displaying it in a SharpShowTextField.

References