Vulnerability advisory

GHSA-mm79-jhqm-9j54

Bypassing Cross-Site Scripting Protection in TYPO3 HTML Sanitizer

Published Nov 14, 2023Updated Sep 10, 2026OSV record ↗

Severity

Affected versions

Affected	Fixed in
`1.0.0` to before 1.5.3	`1.5.3`Advisories →
Also listed as affected (11) `v1.0.0` `v1.0.1` `v1.0.2` `v1.0.3` `v1.0.4` `v1.0.5` `v1.0.6` `v1.0.7` `v1.5.0` `v1.5.1` `v1.5.2`
`2.0.0` to before 2.1.4	`2.1.4`Advisories →
Also listed as affected (21) `v2.0.0` `v2.0.1` `v2.0.10` `v2.0.11` `v2.0.12` `v2.0.13` `v2.0.14` `v2.0.15` `v2.0.16` `v2.0.2` `v2.0.3` `v2.0.4` `v2.0.5` `v2.0.6` `v2.0.7` `v2.0.8` `v2.0.9` `v2.1.0` `v2.1.1` `v2.1.2` `v2.1.3`

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C (4.4)

DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer.

Update to typo3/html-sanitizer versions 1.5.3 or 2.1.4 that fix the problem described.

Thanks to Yaniv Nizry and Niels Dossche who reported this issue, and to TYPO3 core & security team member Oliver Hader who fixed the issue.