PT-2026-47448 · Typo3 · Sanitize-Html

Ipc Labs + 1 · CVE-2026-47344 · Published 2026-06-08 · Updated 2026-07-23

Positive Technologies (AI Summary)

CVSS v4.0

2.1

Low

Base vector

AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions typo3/html-sanitizer versions prior to 2.3.2

Description When the ALLOW INSECURE RAW TEXT setting is enabled, the sanitizer fails to recognize closing tags containing whitespace variants, such as </stylet>. Because browsers interpret these as valid end tags, subsequent content can escape the sanitization process, enabling a bypass of the cross-site scripting prevention mechanism.

Recommendations Update to version 2.3.2 or later. As a temporary mitigation, disable the ALLOW INSECURE RAW TEXT setting.

Exploit

Fix

XSS

Weakness Enumeration

CWE-436

CWE-79

Related Identifiers

CVE-2026-47344

GHSA-JVF5-RXVV-3MCG

Affected Products

Sanitize-Html

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47344.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/html-sanitizer/CVE-2026-47344.yaml · Exploit
• https://github.com/TYPO3/html-sanitizer/commit/bd1a88d9b5a5f67f1120ec41084e9c1a0675641c · Patch
• https://typo3.org/security/advisory/typo3-core-sa-2026-006 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47344 · Security Note
• https://osv.dev/vulnerability/GHSA-jvf5-rxvv-3mcg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-47344 · Vendor Advisory
• https://github.com/TYPO3/html-sanitizer · Note
• https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-jvf5-rxvv-3mcg · Note
• https://packagist.org · Note
• https://t.me/CVEtracker/56212 · Telegram Post
• https://t.me/cveNotify/214687 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2064085240193118646 · Twitter Post