CVE-2026-47344

CVE-2026-47344

When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows byp…

Vulnerability class: XSS (Cross-Site Scripting)

Weakness classification (CWE)

References