A stored cross‑site scripting vulnerability exists in the SharpEditorFormField component of the code16 Sharp framework. Content that contains the attacker‑controlled data-html‑content attribute bypasses the normal HTML sanitization, allowing the injection of executable markup. When a victim user later views the stored content, the injected code can execute in their browser, potentially compromising their session, harvesting credentials, or defacing the site. The weakness is a classic input validation flaw identified as CWE‑79.

The vulnerability affects all installations of code16:sharp prior to version 9.22.5. The vendor’s own release notes indicate that version 9.22.5 includes a fix. Applications that have intentionally enabled the RAW_HTML option in SharpFormEditorField must still perform their own sanitization to avoid this bypass. No other vendors or unrelated products are impacted.

The CVSS score of 8.7 marks this as a high‑severity issue, reflecting a wide impact on confidentiality and integrity for authenticated users who can submit or edit content. The EPSS score is not available, so the current probability of exploitation is unknown; however, the vulnerability can be abused by any user with write access to the editor field. The problem is not listed in the CISA KEV catalog, indicating no publicly confirmed exploits yet. Attackers could exploit it by submitting malicious content through the editor, optionally disclosing the flaw via public channels or internal reconnaissance. The primary vector is the web interface where the editor form field accepts input from users with sufficient privileges.