CVE-2026-47344
LowCVSS 2.1Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
In typo3/html-sanitizer before version 2.3.2, when ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags are not recognized by the sanitizer but accepted by browsers, allowing XSS bypass.
Risk Assessment
An attacker can inject malicious JavaScript that executes in the victim's browser, leading to session theft, redirects, or other XSS attacks.
Recommendation
Update typo3/html-sanitizer to version 2.3.2 or later and disable ALLOW_INSECURE_RAW_TEXT if not required.
Other vulnerabilities in typo3/html-sanitizer
See all- CVE-2026-47345Medium
Namespace attributes are not encoded correctly during HTML serialization in typo3/html-sanitizer before version 2.3.2. This allows bypassing the XSS prevention mechanism.
- CVE-2023-38500Medium
TYPO3 HTML Sanitizer, an HTML sanitizer tool, has an encoding issue in the serialization layer that allows malicious markup nested in a `noscript` element to be incorrectly encoded. Although `noscript` is disabled by default, it may be enabled in custom configurations, allowing bypassing of the XSS protection mechanism.
Original NVD description (English source)
When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS