TYPO3 HTML Sanitizer allows Cross-site Scripting

BASSO 2.1CVE-2026-47344 · GHSA-jvf5-rxvv-3mcg · Published 08/06/2026 · updated 23/07/2026

In breve

CVE-2026-47344 è una vulnerabilità BASSO (CVSS 2.1) che riguarda typo3/html-sanitizer.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.28%, superiore al 20.8% delle vulnerabilità.
Correzione: aggiornare a 2.3.2 o successiva.

Package	Affected versions	Patched versions
typo3/html-sanitizer Packagist	`< 2.3.2`	`2.3.2`

Description

When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.

Credits to IPC Labs for reporting this vulnerability.

NVD description

When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.