CVE-2026-47345
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Namespace attributes are not encoded correctly during HTML serialization in typo3/html-sanitizer before version 2.3.2. This allows bypassing the XSS prevention mechanism.
Risk Assessment
An attacker can inject malicious HTML/JavaScript that executes in the victim's browser, leading to data theft or session hijacking.
Recommendation
Upgrade typo3/html-sanitizer to version 2.3.2 or later.
Other vulnerabilities in typo3/html-sanitizer
See all- CVE-2026-47344Low
In typo3/html-sanitizer before version 2.3.2, when ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags are not recognized by the sanitizer but accepted by browsers, allowing XSS bypass.
- CVE-2023-38500Medium
TYPO3 HTML Sanitizer, an HTML sanitizer tool, has an encoding issue in the serialization layer that allows malicious markup nested in a `noscript` element to be incorrectly encoded. Although `noscript` is disabled by default, it may be enabled in custom configurations, allowing bypassing of the XSS protection mechanism.
Original NVD description (English source)
Namespace attributes are not encoded correctly during HTML serialization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.