XSS in Typo3 Html Sanitizer

CVE-2026-47344

When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows byp…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.003 (20.4th percentile) — read the EPSS interpretation.