Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Namespace attributes are not encoded correctly during HTML serialization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2. Credits to Doyensec in collaboration with Claude and Anthropic Research for reporting this vulnerability.
Recommended action: Upgrade to 2.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When ALLOWINSECURERAWTEXT is enabled, whitespace-variant closing tags (e.g., </style\\t) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2. Credits to IPC Labs for reporting this vulnerability.
Recommended action: Upgrade to 2.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C (4.4) Problem DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. Solution Update to typo3/html-sanitizer versions 1.5.3 or 2.1.4 that fix the problem described. Credits Thanks to Yaniv Nizry and Niels Dossche who reported this issue, and to TYPO3 core & security team member Oliver Hader who fixed the issue. References TYPO3-CORE-SA-2023-007 Context & Details at masterminds/html5
Recommended action: Upgrade to 2.1.4 or 1.5.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C (4.4) Problem Due to an encoding issue in the serialization layer, malicious markup nested in a noscript element was not encoded correctly. noscript is disabled in the default configuration, but might have been enabled in custom scenarios. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. Solution Update to typo3/html-sanitizer versions 1.5.1 or 2.1.2 that fix the problem described. Credits Thanks to David Klein and Yaniv Nizry who reported this issue, and to TYPO3 security team members Oliver Hader and Benjamin Franzke who fixed the issue. References TYPO3-CORE-SA-2023-002
Recommended action: Upgrade to 2.1.2 or 1.5.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Problem Due to a parsing issue in the upstream package masterminds/html5, malicious markup used in a sequence with special HTML CDATA sections cannot be filtered and sanitized. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. Besides that, the upstream package masterminds/html5 provides HTML raw text elements (script, style, noframes, noembed and iframe) as DOMText nodes, which were not processed and sanitized further. None of the mentioned elements were defined in the default builder configuration, that's why only custom behaviors, using one of those tag names, were vulnerable to cross-site scripting. Solution Update to typo3/html-sanitizer versions 1.5.0 or 2.1.1 that fix the problem described.
Recommended action: Upgrade to 2.1.1 or 1.5.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C (5.7) Problem Due to a parsing issue in upstream package masterminds/html5, malicious markup used in a sequence with special HTML comments cannot be filtered and sanitized. This allows to by-pass the cross-site scripting mechanism of typo3/html-sanitizer. Solution Update to typo3/html-sanitizer versions 1.0.7 or 2.0.16 that fix the problem described. Credits Thanks to David Klein who reported this issue, and to TYPO3 security team member Oliver Hader who fixed the issue.
Recommended action: Upgrade to 2.0.16 or 1.0.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.