CVE-2026-47344: TYPO3 HTML Sanitizer XSS Vulnerability

CVE-2026-47344 Overview

CVE-2026-47344 is a cross-site scripting (XSS) sanitizer bypass affecting the typo3/html-sanitizer library before version 2.3.2. When the ALLOW_INSECURE_RAW_TEXT configuration option is enabled, the sanitizer fails to recognize whitespace-variant closing tags such as </style\t>. Browsers, however, accept these tags as valid end tags per HTML5 specification § 8.2.6.1. This mismatch lets attacker-supplied content escape the raw-text context and reach the rendered DOM as executable markup. The flaw is tracked as [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact

An attacker who can submit HTML content processed by the sanitizer with ALLOW_INSECURE_RAW_TEXT enabled can inject script content that bypasses sanitization and executes in a victim's browser session.

Affected Products

• typo3/html-sanitizer versions prior to 2.3.2
• TYPO3 CMS installations that consume html-sanitizer with ALLOW_INSECURE_RAW_TEXT enabled
• Downstream PHP applications depending on the vulnerable Masterminds\HTML5 tokenizer behavior through typo3/html-sanitizer

Discovery Timeline

• 2026-06-08 - CVE-2026-47344 published to NVD
• 2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-47344

Vulnerability Analysis

The typo3/html-sanitizer library uses the Masterminds\HTML5 parser to tokenize and clean untrusted HTML. The HTML5 specification defines raw-text elements such as <style> and <script> whose contents are not parsed as markup until a matching end tag is encountered. Per § 8.2.6.1, the end tag may include trailing whitespace characters such as tab (\t), newline, or form feed before the closing >.

The vulnerable rawText() tokenizer method only recognized the canonical closing tag form. Attacker-supplied input containing </style\t> or similar whitespace variants passed through the raw-text scanner unchanged. Browsers parsing the resulting HTML correctly treat the whitespace-variant tag as a valid end tag, terminating the raw-text context. Any markup following the bypassed tag is then parsed as ordinary HTML, including <script> blocks or event handler attributes.

Root Cause

The defect resides in the rawText() method of the upstream Masterminds tokenizer, which did not implement HTML5 § 8.2.6.1 whitespace handling for raw-text end tags. The existing rcdata() method already handled whitespace variants correctly, creating a parser-differential between the sanitizer's view of the input and the browser's view. This parser confusion is the underlying cause of the XSS filter bypass.

Attack Vector

An authenticated user with permission to submit HTML content processed by html-sanitizer with ALLOW_INSECURE_RAW_TEXT enabled crafts a payload that opens a raw-text element, closes it using a whitespace-variant end tag, then includes injected script content. User interaction is required to render the malicious page in a victim's browser.

// Patch from src/Parser/Tokenizer.php
<?php

declare(strict_types=1);

namespace TYPO3\HtmlSanitizer\Parser;

use Masterminds\HTML5\Elements;
use Masterminds\HTML5\Parser\Tokenizer as MastermindsTokenizer;

/**
 * Extends the Masterminds tokenizer to fix rawText() so that it recognises
 * whitespace-variant closing tags (e.g. </style\t>) as valid end tags per
 * HTML5 spec § 8.2.6.1, aligning it with the existing rcdata() behaviour.
 */
class Tokenizer extends MastermindsTokenizer
{
    #[\Override]
    protected function rawText($tok): bool
    {
        if ($this->untilTag === null) {
            // ... fixed handling continues

Source: TYPO3 html-sanitizer commit bd1a88d

Detection Methods for CVE-2026-47344

Indicators of Compromise

• HTML content submitted to TYPO3 backends containing closing tags with embedded whitespace such as </style\t>, </style\n>, </textarea\t>, or </script\t>
• Stored content fields where raw-text elements are followed by markup that should have been escaped, including <script> tags or on*= event handler attributes
• Web server access logs showing POST requests to TYPO3 content endpoints with bodies containing tab or newline characters immediately before > inside end tags

Detection Strategies

• Inspect content stored through TYPO3 rich-text fields for whitespace-variant end tags using regular expressions such as </(style|script|textarea|title|xmp|iframe|noembed|noframes|noscript)\s+>
• Compare installed typo3/html-sanitizer versions across deployments against the fixed release 2.3.2 using composer audit tooling
• Identify TYPO3 configurations where ALLOW_INSECURE_RAW_TEXT is enabled, since the flaw is only reachable under that setting

Monitoring Recommendations

• Log and review TYPO3 editor submissions that contain <style>, <script>, or other raw-text elements followed by additional markup
• Enable Content Security Policy (CSP) reporting and alert on script-src violations originating from sanitized content rendering paths
• Track outbound JavaScript execution from pages that render user-submitted HTML, including unusual fetch() or XMLHttpRequest calls to attacker-controlled domains

How to Mitigate CVE-2026-47344

Immediate Actions Required

• Upgrade typo3/html-sanitizer to version 2.3.2 or later using composer update typo3/html-sanitizer
• Audit application configuration and disable ALLOW_INSECURE_RAW_TEXT unless an explicit, reviewed requirement exists
• Review historical user-submitted content for whitespace-variant end-tag payloads and re-sanitize affected records after upgrading

Patch Information

The fix is delivered in typo3/html-sanitizer 2.3.2 via commit bd1a88d9b5a5f67f1120ec41084e9c1a0675641c. The patch introduces a local Tokenizer subclass that overrides rawText() to recognize whitespace-variant end tags, and an Html5 parser subclass that substitutes the corrected tokenizer. Further detail is available in the TYPO3 Security Advisory TYPO3-CORE-SA-2026-006.

Workarounds

• Disable the ALLOW_INSECURE_RAW_TEXT behavior flag in the sanitizer configuration, which fully removes the vulnerable code path
• Apply a strict Content Security Policy that forbids inline scripts and restricts script-src to trusted hashes or nonces, reducing impact if a bypass occurs
• Restrict HTML submission permissions to trusted editor roles until the library is upgraded

# Upgrade the affected library to the fixed release
composer require typo3/html-sanitizer:^2.3.2
composer audit

# Verify the installed version
composer show typo3/html-sanitizer | grep versions