Description
When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TYPO3 | HTML Sanitizer | < 2.3.2 | 2.3.2 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | typo3/html-sanitizer | < 2.3.2 | 2.3.2 | GHSA-jvf5-rxvv-3mcg |
Advisories 1
- WID-SEC-2026-1835 TYPO3 Core: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 9, 2026