En bref
- CVE-2026-47344 est une vulnérabilité FAIBLE (CVSS 2.1) touchant typo3/html-sanitizer.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.28%, plus élevée que 20.8% des vulnérabilités.
- Correctif : mettre à jour vers 2.3.2 ou plus récent.
Description
When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.
Credits to IPC Labs for reporting this vulnerability.
NVD description
When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.
Autres vulnérabilités de typo3/html-sanitizer
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free