Answer in brief
CVE-2026-84974 records a Medium severity (CVSS 5.4) vulnerability in code16/sharp: Arbitrary class instantiation through the embed_key API parameter. The current sources do not mark it as known exploited. The current feed maps code16/sharp (composer), code16/sharp (composer), code16/sharp (composer), code16/sharp (composer) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.4. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps code16/sharp (composer), code16/sharp (composer), code16/sharp (composer), code16/sharp (composer) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| code16/sharpcomposer | <9.23.0 | 9.23.0 |
| code16/sharpcomposer | >=10.0.0-beta.1,<10.0.0-beta.4 | 10.0.0-beta.4 |
| code16/sharpcomposer | <9.23.0 | 9.23.0 |
| code16/sharpcomposer | >=10.0.0-beta.1,<10.0.0-beta.4 | 10.0.0-beta.4 |
| code16/sharppackagist | >=0 <9.23.0 | 9.23.0 |
| code16/sharppackagist | >=10.0.0-beta.1 <10.0.0-beta.4 | 10.0.0-beta.4 |
Published upstream
Nov 12, 2026
Evidence: source:ghsa:source_dates:source-dates:recordSource modified
Nov 12, 2026
Evidence: source:ghsa:source_dates:source-dates:recordFirst seen by HOL
Nov 12, 2026
### Impact An authenticated attacker can instantiate any class in the PHP application by using the `embed_key` parameter across multiple API endpoints. The instantiation is performed by the Laravel container. As a result, the `__construct()` method of the class is called and all constructor dependencies are resolved. The attacker cannot specify parameter values and cannot call any arbitrary method. ### Patches The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. An additional check was added to verify that `embed_key` is a class extending `SharpFormEditorEmbed` before any instantiation. ### Workarounds No known workarounds.
Quoted source text, attributed separately from HOL analysis.