CVE-2026-47345

CVE-2026-47345

Namespace attributes are not encoded correctly during HTML serialization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.004 (29.1th percentile) — read the EPSS interpretation.

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

f4fb688c-4412-4426-b4b8-421ecf27b14a (patch)
f4fb688c-4412-4426-b4b8-421ecf27b14a (vendor-advisory)