Vulnerability advisory

CVE-2026-47345

TYPO3 HTML Sanitizer allows Cross-Site Scripting

Published Jun 8, 2026Updated Oct 28, 2026OSV record ↗

Severity

CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/typo3/html-sanitizer ↗
All commits before 8b5d0be44ded457ca993ec9ca93d859941c63764	`8b5d0be44ded457ca993ec9ca93d859941c63764`
Also listed as affected (25) `v2.3.1` `v2.3.0` `v2.2.0` `v2.1.4` `v2.1.3` `v2.1.2` `v2.1.1` `v2.1.0` `v2.0.16` `v2.0.15` `v2.0.14` `v2.0.13` `v2.0.12` `v2.0.11` `v2.0.10` `v2.0.9` `v2.0.8` `v2.0.7` `v2.0.6` `v2.0.5` `v2.0.4` `v2.0.3` `v2.0.2` `v2.0.1` `v2.0.0`

Description

Namespace attributes are not encoded correctly during HTML serialization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.

References

Webpackagist.org ↗
Advisorygithub.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47345.json ↗
Advisorynvd.nist.gov/vuln/detail/CVE-2026-47345 ↗
Advisorytypo3.org/security/advisory/typo3-core-sa-2026-006 ↗
Fixgithub.com/TYPO3/html-sanitizer/commit/8b5d0be44ded457ca993ec9ca93d859941c63764 ↗
Packagegithub.com/TYPO3/html-sanitizer ↗