Vulnerability advisory

GHSA-jvf5-rxvv-3mcg

TYPO3 HTML Sanitizer allows Cross-site Scripting

Published Jun 12, 2026Updated Sep 10, 2026OSV record ↗

Also known as CVE-2026-47344

Severity

CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Affected versions

typo3/html-sanitizer Packagist

All typo3/html-sanitizer advisories →

Affected	Fixed in
All versions before 2.3.2	`2.3.2`Advisories →
Also listed as affected (37) `v1.0.0` `v1.0.1` `v1.0.2` `v1.0.3` `v1.0.4` `v1.0.5` `v1.0.6` `v1.0.7` `v1.5.0` `v1.5.1` `v1.5.2` `v1.5.3` `v2.0.0` `v2.0.1` `v2.0.10` `v2.0.11` `v2.0.12` `v2.0.13` `v2.0.14` `v2.0.15` `v2.0.16` `v2.0.2` `v2.0.3` `v2.0.4` `v2.0.5` `v2.0.6` `v2.0.7` `v2.0.8` `v2.0.9` `v2.1.0` `v2.1.1` `v2.1.2` `v2.1.3` `v2.1.4` `v2.2.0` `v2.3.0` `v2.3.1`

Description

When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.

Credits to IPC Labs for reporting this vulnerability.

GHSA-jvf5-rxvv-3mcg

Affected versions

typo3/html-sanitizer Packagist

Description

References