Vulnerability · Published Jun 8, 2026 · Assigned by TYPO3

CVE-2026-47344TYPO3 HTML Sanitizer allows Cross-Site Scripting

Low 2.1

In plain English

A low-severity cross-site scripting in HTML Sanitizer from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.1Low

Exploit odds (30 days)0.3%top 79.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	typo3/html-sanitizer	2.3.2	GHSA-jvf5-rxvv-3mcg

Affected products (as reported)

Vendor	Product	Versions
TYPO3	HTML Sanitizer	0 – before 2.3.2

Weakness: CWE-79, CWE-436 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References