Executive Summary

This vulnerability occurs in the TYPO3 html-sanitizer library when the ALLOW_INSECURE_RAW_TEXT option is enabled. It involves improper handling of closing HTML tags that contain whitespace variations, such as </style\t>. These tags are not recognized by the sanitizer as valid end tags but are accepted by browsers, allowing malicious content to bypass the sanitization process.

As a result, attackers can bypass the cross-site scripting (XSS) prevention mechanism by injecting content that escapes sanitization, potentially leading to execution of malicious scripts.

The fix ensures that the HTML5 parser correctly recognizes these whitespace-variant closing tags as valid end tags and prevents raw-text passthrough inside elements like <noscript>, where browsers might otherwise parse content as raw text and allow malicious payloads to escape sanitization.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to bypass the HTML sanitization process and inject malicious scripts into web pages, leading to cross-site scripting (XSS) attacks.

Such XSS attacks can result in unauthorized actions performed on behalf of users, theft of sensitive information like cookies or session tokens, defacement of websites, or distribution of malware.

If your application uses TYPO3 html-sanitizer with the vulnerable configuration, it may be exposed to these risks until updated to a fixed version.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the CVE-2026-47344 vulnerability, update the TYPO3 html-sanitizer library to version 2.3.2 or later, which includes fixes that properly recognize whitespace-variant closing tags as valid end tags and prevent raw-text passthrough inside <noscript> elements.

These fixes involve changes to the parser, tokenizer, and sanitizer components to ensure that raw-text content is properly sanitized and that insecure raw-text behavior is denied in specific contexts.

Useful 0 Not Useful 0