CVE-2025-62798: Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax

The vulnerability is a Cross-Site Scripting (XSS) issue in the code16/sharp package, specifically within the SharpShowTextField component. The root cause is the improper handling of user-provided input, which is rendered as a Vue template. Malicious input containing Vue's template syntax ({{ and }}) was evaluated by the Vue engine instead of being displayed as plain text.

The analysis of the patch commits reveals the core of the vulnerability. Before the fix, the resources/js/show/components/fields/text/TextRenderer.vue component would take content and directly create a dynamic Vue component from it. This behavior is what allowed the template injection.

The patch addresses this in two main ways:

1. It refactors the dynamic template rendering logic into a reusable component, resources/js/components/TemplateRenderer.vue.
2. It introduces a sanitization function, sanitizeForVue, within TemplateRenderer.vue. This function escapes the {{ and }} sequences, preventing Vue from interpreting them as expressions.

The TextRenderer.vue component is modified to use the new, secure TemplateRenderer.vue component, passing the potentially unsafe content to it for rendering. Therefore, the vulnerable functions are the setup scripts of both TextRenderer.vue (which originally contained the unsafe logic) and TemplateRenderer.vue (where the unsafe logic was centralized and then fixed). During exploitation, a profiler would show activity within the rendering and setup phases of these Vue components.