TI-2022-16445 Aliases CVE-2022-36020 GHSA-47m6-46mj-p235

Bypass of Cross-Site Scripting Protection in typo3/html-sanitizer

LOW 29CWE-79Published 2022-09-13 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

The typo3/html-sanitizer package is an HTML sanitizer, written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. Due to a parsing issue in the upstream package `masterminds/html5`, malicious markup used in a sequence with special HTML comments cannot be filtered and sanitized. This allows for a bypass of the cross-site scripting mechanism of `typo3/html-sanitizer`. This issue has been addressed in versions 1.0.7 and 2.0.16 of the `typo3/html-sanitizer` package. Users are advised to upgrade. There are no known workarounds for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00842 58th percentileScored 2026-11-07

Fix Fixed html-sanitizer (TYPO3): 1.0.7, 2.0.16typo3/html-sanitizer (Packagist): 1.0.7, 2.0.16+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TYPO3	html-sanitizer	1.0.0 to before 1.0.7; 2.0.0 to before 2.0.16	1.0.7, 2.0.16	Patch available	CNA
—	typo3/html-sanitizer (Packagist)	1.0.0 to before 1.0.7	1.0.7	Patch available	GHSA-47m6-46mj-p235
—	typo3/html-sanitizer (Packagist)	2.0.0 to before 2.0.16	2.0.16	Patch available	GHSA-47m6-46mj-p235
—	typo3/cms-core (Packagist)	10.0.0 to before 10.4.32	10.4.32	Patch available	GHSA-47m6-46mj-p235
—	typo3/cms-core (Packagist)	11.0.0 to before 11.5.16	11.5.16	Patch available	GHSA-47m6-46mj-p235
—	typo3/cms (Packagist)	10.0.0 to before 10.4.32	10.4.32	Patch available	GHSA-47m6-46mj-p235
—	typo3/cms (Packagist)	11.0.0 to before 11.5.16	11.5.16	Patch available	GHSA-47m6-46mj-p235

html-sanitizer VendorTYPO3 Affected 1.0.0 to before 1.0.7; 2.0.0 to before 2.0.16 Fixed in 1.0.7, 2.0.16 Patch available CNA
typo3/html-sanitizer (Packagist) Vendor— Affected 1.0.0 to before 1.0.7 Fixed in 1.0.7 Patch available GHSA-47m6-46mj-p235
typo3/html-sanitizer (Packagist) Vendor— Affected 2.0.0 to before 2.0.16 Fixed in 2.0.16 Patch available GHSA-47m6-46mj-p235
typo3/cms-core (Packagist) Vendor— Affected 10.0.0 to before 10.4.32 Fixed in 10.4.32 Patch available GHSA-47m6-46mj-p235
typo3/cms-core (Packagist) Vendor— Affected 11.0.0 to before 11.5.16 Fixed in 11.5.16 Patch available GHSA-47m6-46mj-p235
typo3/cms (Packagist) Vendor— Affected 10.0.0 to before 10.4.32 Fixed in 10.4.32 Patch available GHSA-47m6-46mj-p235
typo3/cms (Packagist) Vendor— Affected 11.0.0 to before 11.5.16 Fixed in 11.5.16 Patch available GHSA-47m6-46mj-p235

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:typo3:html_sanitizer::::::::	1.0.0 to before 1.0.7; 2.0.0 to before 2.0.16	Vulnerable	TYPO3

cpe:2.3:a:typo3:html_sanitizer:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.0.7; 2.0.0 to before 2.0.16 Vulnerable ·TYPO3

Remediation

Fix · CNA html-sanitizer (TYPO3) Fixed in 1.0.7, 2.0.16
Fix · GHSA-47m6-46mj-p235 typo3/html-sanitizer (Packagist) Fixed in 1.0.7 Advisory →
Fix · GHSA-47m6-46mj-p235 typo3/html-sanitizer (Packagist) Fixed in 2.0.16 Advisory →
Fix · GHSA-47m6-46mj-p235 typo3/cms-core (Packagist) Fixed in 10.4.32 Advisory →
Fix · GHSA-47m6-46mj-p235 typo3/cms-core (Packagist) Fixed in 11.5.16 Advisory →
Fix · GHSA-47m6-46mj-p235 typo3/cms (Packagist) Fixed in 10.4.32 Advisory →
Fix · GHSA-47m6-46mj-p235 typo3/cms (Packagist) Fixed in 11.5.16 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-36020
2026-10-03 Alias added: GHSA-47m6-46mj-p235

References

Patch 1

https://github.com/TYPO3/html-sanitizer/commit/60bfdc7f9b394d0236e16ee4cea8372a7defa493

Advisory 4

Other 5

TI-2023-25465 By-passing Cross-Site Scripting Protection in HTML Sanitizer CVSS 3.1MEDIUM 6.1
TI-2023-19880 By-passing Cross-Site Scripting Protection in HTML Sanitizer CVSS 3.1MEDIUM 6.1
TI-2022-07558 Cross-Site Scripting Protection bypass in HTML Sanitizer CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences