CVE-2022-23499

CVE-2022-23499 describes a cross-site scripting protection bypass in TYPO3’s HTML sanitizer. The root cause is a parsing issue in the upstream masterminds/html5 library, which allows certain HTML CDATA sequences and raw text elements (script, style, noframes, noembed, iframe) to bypass the saniti...

CVE-2023-47125

CVE-2023-47125 affects TYPO3’s html-sanitizer: DOM processing instructions are not handled correctly, allowing bypass of the built-in XSS protection. Affected TYPO3/core-html-sanitizer versions are mitigated by upgrading to 1.5.3 or 2.1.4, which fix the issue. The vulnerability arises in the sani...

CVE-2022-36020

CVE-2022-36020 affects the TYPO3 HTML sanitizer package (typo3/html-sanitizer). A parsing issue in the upstream masterminds/html5 can fail to filter a sequence of malicious markup with specific HTML comments, bypassing the built-in XSS protection. Affected versions have been fixed in typo3/html-s...

CVE-2023-38500

The CVE-2023-38500 entry concerns TYPO3 HTML Sanitizer, a PHP-based HTML sanitizer. A vulnerability exists in versions 1.0.0 up to, but not including, 1.5.1 and 2.1.2, caused by an encoding issue in the serialization layer that could fail to properly encode malicious markup nested in a noscript e...