CVE-2026-47344
LowCVSS 2.1Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
In typo3/html-sanitizer before version 2.3.2, when ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags are not recognized by the sanitizer but accepted by browsers, allowing XSS bypass.
Risk Assessment
An attacker can inject malicious JavaScript that executes in the victim's browser, leading to session theft, redirects, or other XSS attacks.
Recommendation
Update typo3/html-sanitizer to version 2.3.2 or later and disable ALLOW_INSECURE_RAW_TEXT if not required.
Original NVD description (English source)
When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.