CVE-2023-38500
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
TYPO3 HTML Sanitizer, an HTML sanitizer tool, has an encoding issue in the serialization layer that allows malicious markup nested in a `noscript` element to be incorrectly encoded. Although `noscript` is disabled by default, it may be enabled in custom configurations, allowing bypassing of the XSS protection mechanism.
Risk Assessment
Organizations may be exposed to cross-site scripting attacks if `noscript` is enabled in their configuration, potentially leading to data theft or session hijacking.
Recommendation
It is recommended to update TYPO3 HTML Sanitizer to versions 1.5.1 or 2.1.2 to mitigate this vulnerability. Additionally, check the configuration to ensure that `noscript` is disabled if not needed.
Other vulnerabilities in TYPO3 HTML Sanitizer
See all- CVE-2026-47345Medium
Namespace attributes are not encoded correctly during HTML serialization in typo3/html-sanitizer before version 2.3.2. This allows bypassing the XSS prevention mechanism.
- CVE-2026-47344Low
In typo3/html-sanitizer before version 2.3.2, when ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags are not recognized by the sanitizer but accepted by browsers, allowing XSS bypass.
Original NVD description (English source)
TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, aiming to provide cross-site-scripting-safe markup based on explicitly allowed tags, attributes and values. Starting in version 1.0.0 and prior to versions 1.5.1 and 2.1.2, due to an encoding issue in the serialization layer, malicious markup nested in a `noscript` element was not encoded correctly. `noscript` is disabled in the default configuration, but might have been enabled in custom scenarios. This allows bypassing the cross-site scripting mechanism of TYPO3 HTML Sanitizer. Versions 1.5.1 and 2.1.2 fix the problem.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS