CVE-2025-62798

🗓️ 28 Oct 2025 20:58:21Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 36 Views🌐 WEB

Cross-site scripting flaw in Sharp before version 9.11.1 allows Vue expression evaluation in SharpShowTextField; fixed in 9.11.1.

Reporter	Title	Published	Views	Family All 15
Circl	CVE-2025-62798	29 Oct 202500:08	–	circl
CNNVD	Sharp cross-site scripting vulnerabilities	28 Oct 202500:00	–	cnnvd
Cvelist	CVE-2025-62798 Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax	28 Oct 202520:58	–	cvelist
EUVD	EUVD-2025-36569	29 Oct 202510:52	–	euvd
Github Security Blog	Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax	29 Oct 202510:52	–	github
Mend	CVE-2025-62798	28 Oct 202520:58	–	mend
NVD	CVE-2025-62798	28 Oct 202521:15	–	nvd
osv_ghsa	GHSA-9F58-4465-23C7 Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax	29 Oct 202510:52	–	osv_ghsa
Positive Technologies	PT-2025-44216	28 Oct 202500:00	–	ptsecurity
Positive Technologies	PT-2025-45695	29 Oct 202500:00	–	ptsecurity

Vulners

Node

code16 sharpRange<9.11.1

[
  {
    "vendor": "code16",
    "product": "sharp",
    "versions": [
      {
        "version": "< 9.11.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/code16/sharp/security/advisories/GHSA-9f58-4465-23c7
github	www.github.com/code16/sharp/pull/654
github	www.github.com/code16/sharp/releases/tag/v9.11.1

Parameter	Position	Path	Description	CWE
expressions wrapped in {{ & }}	request body	/SharpShowTextField	XSS vulnerability in SharpShowTextField component where expressions wrapped in {{ & }} are evaluated by Vue, allowing injection of arbitrary JavaScript or HTML.	CWE-79

08 Oct 2026 11:10Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.15.4

EPSS0.00216

SSVC

CWE-79