GCVE - cpe:2.3:a:typo3:html_sanitizer:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:typo3:html_sanitizer:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Typo3 (`bebcd01c-0947-5641-89ed-9b814cca944e`)
Product	Html Sanitizer (`6eeeaf7a-29f7-5d16-a7b5-458f9a0f4158`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/typo3/html-sanitizer`	purl2cpe	2026-06-01 10:16:08.458322

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-47345`	vulnerable	2026-07-29 00:55:00.127008	TYPO3 HTML Sanitizer allows Cross-Site Scripting Namespace attributes are not encoded correctly during HTML serialization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2. Published: 2026-06-08T19:04:08.337Z Updated: 2026-06-08T19:49:59.995Z Open on db.gcve.eu Reference links https://typo3.org/security/advisory/typo3-core-sa-2026-006 https://github.com/TYPO3/html-sanitizer/commit/8b5d0be44ded457ca993ec9ca93d859941c63764	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-47344`	vulnerable	2026-07-29 00:55:00.126759	TYPO3 HTML Sanitizer allows Cross-Site Scripting When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2. Published: 2026-06-08T19:03:19.826Z Updated: 2026-06-08T19:50:47.479Z Open on db.gcve.eu Reference links https://typo3.org/security/advisory/typo3-core-sa-2026-006 https://github.com/TYPO3/html-sanitizer/commit/bd1a88d9b5a5f67f1120ec41084e9c1a0675641c	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-47125`	vulnerable	2026-06-08 06:14:24.021621	By-passing Cross-Site Scripting Protection in HTML Sanitizer MEDIUM (4.7) TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vulnerability has been addressed in versions 1.5.3 and 2.1.4. Users are advised to upgrade. There are no known workarounds for this vulnerability. Published: 2023-11-14T20:07:56.433Z Updated: 2024-08-29T20:25:31.869Z Open on db.gcve.eu Reference links https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-mm79-jhqm-9j54 https://github.com/TYPO3/html-sanitizer/commit/b8f90717251d968c49dc77f8c1e5912e2fbe0dff https://typo3.org/security/advisory/typo3-core-sa-2023-007	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-38500`	vulnerable	2026-06-08 06:08:18.114444	By-passing Cross-Site Scripting Protection in HTML Sanitizer MEDIUM (4.7) TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, aiming to provide cross-site-scripting-safe markup based on explicitly allowed tags, attributes and values. Starting in version 1.0.0 and prior to versions 1.5.1 and 2.1.2, due to an encoding issue in the serialization layer, malicious markup nested in a `noscript` element was not encoded correctly. `noscript` is disabled in the default configuration, but might have been enabled in custom scenarios. This allows bypassing the cross-site scripting mechanism of TYPO3 HTML Sanitizer. Versions 1.5.1 and 2.1.2 fix the problem. Published: 2023-07-25T20:59:53.135Z Updated: 2024-10-10T17:36:20.315Z Open on db.gcve.eu Reference links https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-59jf-3q9v-rh6g https://github.com/TYPO3/html-sanitizer/commit/e3026f589fef0be8c3574ee3f0a0bfbe33d7ebdb https://typo3.org/security/advisory/typo3-core-sa-2023-002	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-36020`	vulnerable	2026-06-08 05:46:06.161349	Bypass of Cross-Site Scripting Protection in typo3/html-sanitizer MEDIUM (6.1) The typo3/html-sanitizer package is an HTML sanitizer, written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. Due to a parsing issue in the upstream package `masterminds/html5`, malicious markup used in a sequence with special HTML comments cannot be filtered and sanitized. This allows for a bypass of the cross-site scripting mechanism of `typo3/html-sanitizer`. This issue has been addressed in versions 1.0.7 and 2.0.16 of the `typo3/html-sanitizer` package. Users are advised to upgrade. There are no known workarounds for this issue. Published: 2022-09-13T16:55:10.000Z Updated: 2025-04-23T17:11:55.867Z Open on db.gcve.eu Reference links https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-47m6-46mj-p235 https://github.com/TYPO3/html-sanitizer/commit/60bfdc7f9b394d0236e16ee4cea8372a7defa493 https://packagist.org/packages/masterminds/html5 https://packagist.org/packages/typo3/html-sanitizer	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-23499`	vulnerable	2026-06-08 05:40:57.653982	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.