PT-2026-47449 · Typo3 · Sanitize-Html

Benjamin Franzke · Published 2026-06-08 · Updated 2026-06-08 · CVE-2026-47345

Mitre

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Namespace attributes are not encoded correctly during HTML serialization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-47345

Affected Products

Sanitize-Html

References · 3

• https://github.com/TYPO3/html-sanitizer/commit/8b5d0be44ded457ca993ec9ca93d859941c63764 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-47345 · Security Note
• https://typo3.org/security/advisory/typo3-core-sa-2026-006 · Vendor Advisory