CVE-2026-47344: TYPO3 html-sanitizer XSS bypass via whitespace-variant closing tags

Executive brief

The TYPO3 HTML Sanitizer, a tool used to clean user-provided content and prevent malicious scripts from running in web browsers, contains a flaw when a specific insecure text mode is enabled. An attacker could bypass the security filters by using specially formatted HTML tags that the sanitizer ignores but browsers still execute. This could lead to cross-site scripting (XSS) attacks, potentially allowing unauthorized actions in a user's session.

Technical details

A cross-site scripting (XSS) vulnerability exists in the TYPO3 HTML Sanitizer when the ALLOW_INSECURE_RAW_TEXT configuration is enabled. The root cause is a discrepancy between how the sanitizer and web browsers parse closing tags containing whitespace characters (such as tabs). While the sanitizer fails to recognize these as valid end tags, browsers treat them as legitimate, allowing an attacker to break out of raw text elements (like <style> or <script>) and inject malicious markup. This bypasses the library's primary XSS prevention mechanism. The issue is fixed in version 2.3.2.

Affected products

• TYPO3 html-sanitizer < 2.3.2

Timeline

• 2026-06-08: disclosed
• 2026-06-12: advisory

References

• https://api.github.com/users/ohader
• https://github.com/ohader
• https://api.github.com/users/ohader/gists%7B/gist_id%7D
• https://api.github.com/users/ohader/repos
• https://avatars.githubusercontent.com/u/402145?v=4
• https://api.github.com/users/ohader/events%7B/privacy%7D