CVE-2026-84974 | code16 Sharp prior 9.23.0/10.0.0-beta.4 API endpoint __construct embed_key externally-controlled input to select classes or code

November 12, 2026 Yanac

A vulnerability marked as critical has been reported in code16 Sharp. This impacts the function __construct of the component API endpoint. This manipulation of the argument embed_key causes use of externally-controlled input to select classes or code.

The identification of this vulnerability is CVE-2026-84974. It is possible to initiate the attack remotely. There is no exploit available.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More