TI-2026-34920 CVE-2026-47345 · GHSA-p5j5-4j3q-8mq8
TYPO3 HTML Sanitizer allows Cross-Site Scripting
Priority LOW 24
Namespace attributes are not encoded correctly during HTML serialization.
Vulnerabilities
2 records
Advisory: TYPO3 HTML Sanitizer — typo3.org/security/advisory/typo3-core-sa-2026-006 Clear all filters
TI-2026-34919 CVE-2026-47344 · GHSA-jvf5-rxvv-3mcg
TYPO3 HTML Sanitizer allows Cross-Site Scripting
Priority LOW 11
When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitizati…