PT-2026-47449

CVE-2026-47345

Published

2026-06-08

Updated

2026-07-23

Description by

CVSS 4.0

5.1

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions typo3/html-sanitizer versions prior to 2.3.2

Description Namespace attributes are not encoded correctly during HTML serialization. This flaw allows the cross-site scripting prevention mechanism to be bypassed. Cross-site scripting is a technique where malicious scripts are injected into otherwise benign and trusted websites.

Recommendations Update to version 2.3.2 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Benjamin Franzke

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers