TYPO3 HTML Sanitizer allows Cross-site Scripting

低 2.1CVE-2026-47344 · GHSA-jvf5-rxvv-3mcg · 08/06/2026 公開 · 23/07/2026 更新

要点

CVE-2026-47344 は typo3/html-sanitizer に影響する深刻度「低」 (CVSS 2.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.28%（全脆弱性の 20.8% より高い）。
対処：2.3.2 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
typo3/html-sanitizer Packagist	`< 2.3.2`	`2.3.2`

概要

When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.

Credits to IPC Labs for reporting this vulnerability.

NVD の説明

When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.