-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two key issues: 1) Improper handling of CDATA sections parsed as DOMText nodes by masterminds/html5, and 2) Lack of processing for raw text elements returned as DOMText. The CommonVisitor's text node handling (visitText) was vulnerable because it didn't escape CDATA content or process raw text elements. The CommonBuilder's configuration gap (createBehavior) left these elements unregulated. The security patches explicitly modified these components to add CDATA escaping and raw text element processing, confirming their role in the vulnerability.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/html-sanitizer | composer | >= 1.0.0, < 1.5.0 | 1.5.0 |
| typo3/html-sanitizer | composer | >= 2.0.0, < 2.1.1 | 2.1.1 |
| typo3/cms |
| composer |
| >= 10.0.0, < 10.4.33 |
| 10.4.33 |
| typo3/cms | composer | >= 11.0.0, < 11.5.20 | 11.5.20 |
| typo3/cms | composer | >= 12.0.0, < 12.1.1 | 12.1.1 |
Ongoing coverage of React2Shell