Vulnerability advisory

GHSA-p5j5-4j3q-8mq8

TYPO3 HTML Sanitizer allows Cross-site Scripting

Published Jun 12, 2026Updated Sep 10, 2026OSV record ↗

Also known as CVE-2026-47345

Severity

CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Affected versions

typo3/html-sanitizer Packagist

All typo3/html-sanitizer advisories →

Affected	Fixed in
All versions before 2.3.2	`2.3.2`Advisories →
Also listed as affected (37) `v1.0.0` `v1.0.1` `v1.0.2` `v1.0.3` `v1.0.4` `v1.0.5` `v1.0.6` `v1.0.7` `v1.5.0` `v1.5.1` `v1.5.2` `v1.5.3` `v2.0.0` `v2.0.1` `v2.0.10` `v2.0.11` `v2.0.12` `v2.0.13` `v2.0.14` `v2.0.15` `v2.0.16` `v2.0.2` `v2.0.3` `v2.0.4` `v2.0.5` `v2.0.6` `v2.0.7` `v2.0.8` `v2.0.9` `v2.1.0` `v2.1.1` `v2.1.2` `v2.1.3` `v2.1.4` `v2.2.0` `v2.3.0` `v2.3.1`

Description

Namespace attributes are not encoded correctly during HTML serialization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.

Credits to Doyensec in collaboration with Claude and Anthropic Research for reporting this vulnerability.

GHSA-p5j5-4j3q-8mq8

Affected versions

typo3/html-sanitizer Packagist

Description

References