Description
Namespace attributes are not encoded correctly during HTML serialization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TYPO3 | HTML Sanitizer | < 2.3.2 | 2.3.2 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | typo3/html-sanitizer | < 2.3.2 | 2.3.2 | GHSA-p5j5-4j3q-8mq8 |
Advisories 1
- WID-SEC-2026-1835 TYPO3 Core: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 9, 2026