Medium severity5.4NVD Advisory· Published Nov 12, 2026· Updated Nov 12, 2026
code16/sharp: Server-side request forgery through an unanchored autocomplete endpoint check
CVE-2026-84987
Description
Impact
An authenticated attacker can call the Autocomplete API with the configured endpoint as a substring to request another server-side route.
Patches
The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. The regex verifying the endpoint has been anchored to forbid substring injection.
Workarounds
Use SharpFormAutocompleteRemoteField::setRemoteCallback() instead of SharpFormAutocompleteRemoteField::setRemoteEndpoint().
Affected products
1Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-g6f8-c3x9-jv7fghsaADVISORY
- github.com/code16/sharp/commit/339f89110f36d06eaad3f2b4bd048fa5424e5558ghsa
- github.com/code16/sharp/pull/748ghsa
- github.com/code16/sharp/releases/tag/v9.23.0ghsa
- github.com/code16/sharp/security/advisories/GHSA-g6f8-c3x9-jv7fghsa
- github.com/code16/sharp/tree/v10.0.0-beta.4ghsa
News mentions
0No linked articles in our index yet.