EUVD-2026-35191

TYPO3 HTML Sanitizer allows Cross-site Scripting...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the ALLOWINSECURERAWTEXT configuration, the sanitizer fails to recognize whitespace-variant closing tags, such as , which are accepted by browsers as valid end tags. An attacker can inject malicious scripts b...