code16 Sharp is a Laravel-based framework that uses a rich‑text editor for content management. The sanitizer incorrectly permits iframe elements with a srcdoc attribute, allowing an authenticated editor to store JavaScript inside that attribute. When another user views the content, the browser decodes the encoded HTML within srcdoc and executes the script in the user’s context. The stored payload can hijack the user’s session, perform unauthorized actions, take over the account, elevate privileges or reveal administrative data.

Versions of code16 Sharp earlier than 9.22.5 are affected. The vulnerability specifically exists in the framework’s editor component used by administrators and editors with permission to modify content.

The CVSS score of 7.3 reflects a high risk of exploitation. Because the attacker must be authenticated to edit content, the attack vector is local, but the stored script runs in the context of any user who views the compromised content. The EPSS score is not available, and the vulnerability is not yet listed in CISA KEV, indicating that known exploits are not publicly documented yet.