PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-47344 TYPO3 CVE debrief

CVE-2026-47344 is a low-severity vulnerability in typo3/html-sanitizer that allows bypassing the cross-site scripting prevention mechanism. The vulnerability occurs when ALLOW_INSECURE_RAW_TEXT is enabled, and whitespace-variant closing tags are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This vulnerability was published on [cvePublishedAt] and modified on [cveModifiedAt].

Vendor
TYPO3
Product
HTML Sanitizer
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-07-23
Advisory published
2026-06-08
Advisory updated
2026-07-23

Who should care

Users of typo3/html-sanitizer before version 2.3.2 who have ALLOW_INSECURE_RAW_TEXT enabled should be aware of this vulnerability.

Technical summary

The vulnerability occurs when ALLOW_INSECURE_RAW_TEXT is enabled, and whitespace-variant closing tags (e.g., </style> or </style with trailing whitespace) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization.

Defensive priority

Low

Recommended defensive actions

  • Update typo3/html-sanitizer to version 2.3.2 or later.
  • Disable ALLOW_INSECURE_RAW_TEXT if possible.

Evidence notes

The CVE record and NVD detail can be found at [resourceLinkAnnotations:cve-org] and [resourceLinkAnnotations:nvd], respectively. Additional information can be found at [resourceLinkAnnotations:ref-4] and [resourceLinkAnnotations:ref-5].

Sources and references

Verified primary and authoritative sources

  • CVE-2026-47344 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-47344

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-47344 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-47344

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://github.com/TYPO3/html-sanitizer/commit/bd1a88d9b5a5f67f1120ec41084e9c1a0675641c

    f4fb688c-4412-4426-b4b8-421ecf27b14a

  • Source reference

    Unverified legacy reference

    URL: https://typo3.org/security/advisory/typo3-core-sa-2026-006

    f4fb688c-4412-4426-b4b8-421ecf27b14a

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.