Read the docs
TI-2023-19880 Aliases CVE-2023-38500GHSA-59jf-3q9v-rh6g

By-passing Cross-Site Scripting Protection in HTML Sanitizer

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, aiming to provide cross-site-scripting-safe markup based on explicitly allowed tags, attributes and values. Starting in version 1.0.0 and prior to versions 1.5.1 and 2.1.2, due to an encoding issue in the serialization layer, malicious markup nested in a `noscript` element was not encoded correctly. `noscript` is disabled in the default configuration, but might have been enabled in custom scenarios. This allows bypassing the cross-site scripting mechanism of TYPO3 HTML Sanitizer. Versions 1.5.1 and 2.1.2 fix the problem.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00508 43rd percentileScored 2026-11-07
Fix Fixed html-sanitizer (TYPO3): 1.5.1, 2.1.2typo3/html-sanitizer (Packagist): 1.5.1, 2.1.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TYPO3html-sanitizer1.0.0 to before 1.5.1; 2.0.0 to before 2.1.21.5.1, 2.1.2Patch availableCNA
—typo3/html-sanitizer (Packagist)1.0.0 to before 1.5.11.5.1Patch availableGHSA-59jf-3q9v-rh6g
—typo3/html-sanitizer (Packagist)2.0.0 to before 2.1.22.1.2Patch availableGHSA-59jf-3q9v-rh6g
  • html-sanitizer VendorTYPO3 Affected 1.0.0 to before 1.5.1; 2.0.0 to before 2.1.2 Fixed in 1.5.1, 2.1.2 Patch available CNA
  • typo3/html-sanitizer (Packagist) Vendor— Affected 1.0.0 to before 1.5.1 Fixed in 1.5.1 Patch available GHSA-59jf-3q9v-rh6g
  • typo3/html-sanitizer (Packagist) Vendor— Affected 2.0.0 to before 2.1.2 Fixed in 2.1.2 Patch available GHSA-59jf-3q9v-rh6g

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:typo3:html_sanitizer:*:*:*:*:*:*:*:*1.0.0 to before 1.5.1; 2.0.0 to before 2.1.2VulnerableTYPO3
  • cpe:2.3:a:typo3:html_sanitizer:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.5.1; 2.0.0 to before 2.1.2 Vulnerable ·TYPO3

Remediation

  • Fix · CNA html-sanitizer (TYPO3) Fixed in 1.5.1, 2.1.2
  • Fix · GHSA-59jf-3q9v-rh6g typo3/html-sanitizer (Packagist) Fixed in 1.5.1 Advisory →
  • Fix · GHSA-59jf-3q9v-rh6g typo3/html-sanitizer (Packagist) Fixed in 2.1.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-38500
  2. 2026-10-03 Alias added: GHSA-59jf-3q9v-rh6g

References

Patch 1

Advisory 3

Other 1

  • TI-2022-16445 Bypass of Cross-Site Scripting Protection in typo3/html-sanitizer CVSS 3.1MEDIUM 6.1
  • TI-2023-25465 By-passing Cross-Site Scripting Protection in HTML Sanitizer CVSS 3.1MEDIUM 6.1
  • TI-2022-07558 Cross-Site Scripting Protection bypass in HTML Sanitizer CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences