TYPO3 HTML Sanitizer allows Cross-site Scripting
Date: 2026-06
Affected: composer/typo3/html-sanitizer
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-47344
CVE-2026-47345
CWE: CWE-79

Namespace attributes are not encoded correctly during HTML serialization. This allows bypassing the cross-site scripting prevention mechanism of `typo3/html-sanitizer` before version 2.3.2. Credits to Doyensec in collaboration with Claude and Anthropic Research for reporting this vulnerability.


Mitigations:

Architectural layers (MAESTRO):