MEDIUMCVSS 5.4Vulnerability
CVE-2026-84987
### Impact An authenticated attacker can call the Autocomplete API with the configured endpoint as a substring to request another server-side route. ### Patches The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. The regex verifying the endpoint has been anchored to forbid substring injection. ### Workarounds Use `SharpFormAutocompleteRemoteField::setRemoteCallback()` instead of `SharpFormAutocompleteRemoteField::setRemoteEndpoint()`.
Properties
- Severity
- medium
- Summary
- code16/sharp: Server-side request forgery through an unanchored autocomplete endpoint check
- Cvss score
- 5.4
- Retrieved at
- 2026-11-14T00:50:09+00:00
- Ghsa published
- 2026-11-12T18:21:00Z
- Source url
- https://github.com/advisories/GHSA-g6f8-c3x9-jv7f
- Ghsa updated
- 2026-11-12T18:21:01Z
- Ghsa id
- GHSA-g6f8-c3x9-jv7f
- Last source
- GitHub Advisory Database
- Cve id
- CVE-2026-84987
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- First seen by Signal
- 2026-11-12T19:59:26+00:00
- Name
- CVE-2026-84987
- Is ghsa only
- false
Related Entities (4)
HAS_WEAKNESS (2)
AFFECTS (1)
VULNERABLE_TO (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph