Vulnerability Description
When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.
Related Weaknesses (CWE)
References
- https://github.com/TYPO3/html-sanitizer/commit/bd1a88d9b5a5f67f1120ec41084e9c1a0
- https://typo3.org/security/advisory/typo3-core-sa-2026-006
FAQ
What is CVE-2026-47344?
CVE-2026-47344 is a documented vulnerability. When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content ...
How severe is CVE-2026-47344?
CVSS scoring is not yet available for CVE-2026-47344. Check NVD for updates.
Is there a patch for CVE-2026-47344?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.