typo3/html-sanitizer vulnerabilities
3 known CVE vulnerabilities in typo3/html-sanitizer, translated and rated.
- CVE-2026-47345Medium
Namespace attributes are not encoded correctly during HTML serialization in typo3/html-sanitizer before version 2.3.2. This allows bypassing the XSS prevention mechanism.
- CVE-2026-47344Low
In typo3/html-sanitizer before version 2.3.2, when ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags are not recognized by the sanitizer but accepted by browsers, allowing XSS bypass.
- CVE-2023-38500Medium
TYPO3 HTML Sanitizer, an HTML sanitizer tool, has an encoding issue in the serialization layer that allows malicious markup nested in a `noscript` element to be incorrectly encoded. Although `noscript` is disabled by default, it may be enabled in custom configurations, allowing bypassing of the XSS protection mechanism.