CVE-2022-36020

Name of the Vulnerable Software and Affected Versions typo3/html-sanitizer versions prior to 1.0.7 typo3/html-sanitizer versions prior to 2.0.16

Description The typo3/html-sanitizer package, an HTML sanitizer written in PHP, has a parsing issue due to the upstream package masterminds/html5. This issue allows malicious markup used in a sequence with special HTML comments to bypass the cross-site scripting mechanism.

Recommendations For versions prior to 1.0.7, update to version 1.0.7 to resolve the issue. For versions prior to 2.0.16, update to version 2.0.16 to resolve the issue.