CVE-2026-47344
TYPO3 HTML Sanitizer allows Cross-Site Scripting
When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
TYPO3 HTML Sanitizer allows Cross-Site Scripting
When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.
- Record
CVE-2026-47344- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-79, CWE-436
- Updated
- 2026-11-02
EUVDEUVD-2026-35191
When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.
- Record
EUVD-2026-35191- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jvf5-rxvv-3mcg
TYPO3 HTML Sanitizer allows Cross-site Scripting
When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.
Credits to IPC Labs for reporting this vulnerability.
- Record
GHSA-jvf5-rxvv-3mcg- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.
- Record
CVE-2026-47344- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-79, CWE-436
- Updated
- 2026-11-02
OSV
TYPO3 HTML Sanitizer allows Cross-Site Scripting
When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.
- Record
CVE-2026-47344- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-436, CWE-79
- Updated
- 2026-11-02
OSVGHSA-jvf5-rxvv-3mcg
TYPO3 HTML Sanitizer allows Cross-site Scripting
When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.
Credits to IPC Labs for reporting this vulnerability.
- Record
GHSA-jvf5-rxvv-3mcg- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/html-sanitizerPackagist |
before 2.3.2 | 2.3.2 |
typo3/html-sanitizerPackagist |
before 2.3.2, plus listed versions v1.0.0v1.0.1v1.0.2v1.0.3v1.0.4 Show 32 moreShow lessv1.0.5v1.0.6v1.0.7v1.5.0v1.5.1v1.5.2v1.5.3v2.0.0v2.0.1v2.0.10v2.0.11v2.0.12v2.0.13v2.0.14v2.0.15v2.0.16v2.0.2v2.0.3v2.0.4v2.0.5v2.0.6v2.0.7v2.0.8v2.0.9v2.1.0v2.1.1v2.1.2v2.1.3v2.1.4v2.2.0v2.3.0v2.3.1 |
2.3.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-47344 is a low vulnerability (CVSS 2.1) in Typo3 Html Sanitizer, published June 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in typo3/html-sanitizer 2.3.2.
References
typo3.org/security/advisory/typo3-core-sa-2026-006
github.com/TYPO3/html-sanitizer/commit/bd1a88d9b5a5f67f1120ec41084e9c1a0675641c
nvd.nist.gov/vuln/detail/CVE-2026-47344
packagist.org