Cross-Site Scripting Protection bypass in HTML Sanitizer
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
HTML sanitizer is written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. In versions prior to 1.5.0 or 2.1.1, malicious markup used in a sequence with special HTML CDATA sections cannot be filtered and sanitized due to a parsing issue in the upstream package masterminds/html5. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. The upstream package masterminds/html5 provides HTML raw text elements (`script`, `style`, `noframes`, `noembed` and `iframe`) as DOMText nodes, which were not processed and sanitized further. None of the mentioned elements were defined in the default builder configuration, that's why only custom behaviors, using one of those tag names, were vulnerable to cross-site scripting. This issue has been fixed in versions 1.5.0 and 2.1.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TYPO3 | html-sanitizer | 1.0.0 to before 1.5.0; 2.0.0 to before 2.1.1 | 1.5.0, 2.1.1 | Patch available | CNA |
| — | typo3/html-sanitizer (Packagist) | 1.0.0 to before 1.5.0 | 1.5.0 | Patch available | GHSA-hvwx-qh2h-xcfj |
| — | typo3/html-sanitizer (Packagist) | 2.0.0 to before 2.1.1 | 2.1.1 | Patch available | GHSA-hvwx-qh2h-xcfj |
| — | typo3/cms (Packagist) | 10.0.0 to before 10.4.33 | 10.4.33 | Patch available | GHSA-hvwx-qh2h-xcfj |
| — | typo3/cms (Packagist) | 11.0.0 to before 11.5.20 | 11.5.20 | Patch available | GHSA-hvwx-qh2h-xcfj |
| — | typo3/cms (Packagist) | 12.0.0 to before 12.1.1 | 12.1.1 | Patch available | GHSA-hvwx-qh2h-xcfj |
- html-sanitizer VendorTYPO3 Affected 1.0.0 to before 1.5.0; 2.0.0 to before 2.1.1 Fixed in 1.5.0, 2.1.1 Patch available CNA
- typo3/html-sanitizer (Packagist) Vendor— Affected 1.0.0 to before 1.5.0 Fixed in 1.5.0 Patch available GHSA-hvwx-qh2h-xcfj
- typo3/html-sanitizer (Packagist) Vendor— Affected 2.0.0 to before 2.1.1 Fixed in 2.1.1 Patch available GHSA-hvwx-qh2h-xcfj
- typo3/cms (Packagist) Vendor— Affected 10.0.0 to before 10.4.33 Fixed in 10.4.33 Patch available GHSA-hvwx-qh2h-xcfj
- typo3/cms (Packagist) Vendor— Affected 11.0.0 to before 11.5.20 Fixed in 11.5.20 Patch available GHSA-hvwx-qh2h-xcfj
- typo3/cms (Packagist) Vendor— Affected 12.0.0 to before 12.1.1 Fixed in 12.1.1 Patch available GHSA-hvwx-qh2h-xcfj
Remediation
- Fix · CNA html-sanitizer (TYPO3) Fixed in 1.5.0, 2.1.1
- Fix · GHSA-hvwx-qh2h-xcfj typo3/html-sanitizer (Packagist) Fixed in 1.5.0 Advisory →
- Fix · GHSA-hvwx-qh2h-xcfj typo3/html-sanitizer (Packagist) Fixed in 2.1.1 Advisory →
- Fix · GHSA-hvwx-qh2h-xcfj typo3/cms (Packagist) Fixed in 10.4.33 Advisory →
- Fix · GHSA-hvwx-qh2h-xcfj typo3/cms (Packagist) Fixed in 11.5.20 Advisory →
- Fix · GHSA-hvwx-qh2h-xcfj typo3/cms (Packagist) Fixed in 12.1.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-23499
- 2026-10-03 Alias added: GHSA-hvwx-qh2h-xcfj
References
Advisory 2
Other 7
- https://github.com/TYPO3/html-sanitizer/pull/105
- https://github.com/TYPO3/html-sanitizer/pull/106
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2022-23499.yaml
- https://github.com/TYPO3/html-sanitizer
- https://github.com/TYPO3/html-sanitizer/releases/tag/v1.5.0
- https://github.com/TYPO3/html-sanitizer/releases/tag/v2.1.1
- https://typo3.org/security/advisory/typo3-core-sa-2022-017
More TYPO3 Html Sanitizer vulnerabilities
- TI-2022-16445 Bypass of Cross-Site Scripting Protection in typo3/html-sanitizer CVSS 3.1MEDIUM 6.1
- TI-2023-25465 By-passing Cross-Site Scripting Protection in HTML Sanitizer CVSS 3.1MEDIUM 6.1
- TI-2023-19880 By-passing Cross-Site Scripting Protection in HTML Sanitizer CVSS 3.1MEDIUM 6.1
Sources
- CVE-2022-23499 · CVE Program
- CVE-2022-23499 · NVD
- FIRST EPSS
- GHSA-hvwx-qh2h-xcfj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences