Skip to content
OpenAdvisories

Product · TYPO3

HTML Sanitizer

6 known vulnerabilities.

HTML Sanitizer at a glance

Last 12 months
2
Critical · all time
0
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 2 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202620
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Most common weaknesses

All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • Medium 5.1
    CVE-2026-47345

    TYPO3 HTML Sanitizer allows Cross-Site Scripting

    Namespace attributes are not encoded correctly during HTML serialization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.

    TYPO3 HTML Sanitizer typo3/html-sanitizer Packagist
  • Low 2.1
    CVE-2026-47344

    TYPO3 HTML Sanitizer allows Cross-Site Scripting

    When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-sit…

    TYPO3 HTML Sanitizer typo3/html-sanitizer Packagist
  • Medium 4.7
    CVE-2023-47125 Public exploit

    By-passing Cross-Site Scripting Protection in HTML Sanitizer

    TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vuln…

    TYPO3 HTML Sanitizer typo3/html-sanitizer Packagist
  • Medium 4.7
    CVE-2023-38500

    By-passing Cross-Site Scripting Protection in HTML Sanitizer

    TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, aiming to provide cross-site-scripting-safe markup based on explicitly allowed tags, attributes and values. Starting in version 1.0.0 and prior to versions 1.5.1 and 2.1.2, due to an encoding issue in…

    TYPO3 HTML Sanitizer typo3/html-sanitizer Packagist
  • Medium 6.1
    CVE-2022-23499

    Cross-Site Scripting Protection bypass in HTML Sanitizer

    HTML sanitizer is written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. In versions prior to 1.5.0 or 2.1.1, malicious markup used in a sequence with special HTML CDATA sections cannot be filtered and sanit…

    TYPO3 HTML Sanitizer typo3/cms typo3/html-sanitizer Packagist
  • Medium 6.1
    CVE-2022-36020

    Bypass of Cross-Site Scripting Protection in typo3/html-sanitizer

    The typo3/html-sanitizer package is an HTML sanitizer, written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. Due to a parsing issue in the upstream package `masterminds/html5`, malicious markup used in a se…

    TYPO3 HTML Sanitizer typo3/cms typo3/cms-core Packagist