TYPO3 HTML Sanitizer allows Cross-site Scripting
Published 12 Jun 2026 · Updated 10 Sept 2026
Affected package
- Affected
- <2.3.2
- Fixed in
- 2.3.2
composer require typo3/html-sanitizer:^2.3.2Details
When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.
Credits to IPC Labs for reporting this vulnerability.
Is GHSA-jvf5-rxvv-3mcg in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected typo3/html-sanitizer, and gives you the command that fixes it.
References
- Linkgithub.com/TYPO3/html-sanitizer/security/advisories/GHSA-jvf5-rxvv-3mcg
- Advisorynvd.nist.gov/vuln/detail/CVE-2026-47344
- Linkgithub.com/TYPO3/html-sanitizer/commit/bd1a88d9b5a5f67f1120ec41084e9c1a0675641c
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/typo3/html-sanitizer/CVE-2026-47344.yaml
- Packagegithub.com/TYPO3/html-sanitizer
- Linktypo3.org/security/advisory/typo3-core-sa-2026-006
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.