The vulnerability stems from a parsing issue in the upstream package masterminds/html5, which the TYPO3 HTML sanitizer (typo3/html-sanitizer) depends on. The TYPO3 packages themselves do not contain the vulnerable parsing logic but rely on the outdated masterminds/html5 library. The vulnerability occurs because the parser fails to correctly handle HTML comments followed by malicious markup, allowing XSS bypass. The fix involved updating the dependency to a patched version of masterminds/html5, indicating the root cause was in the third-party library. No specific functions within the TYPO3 packages (e.g., typo3/html-sanitizer) were identified as directly vulnerable with high confidence; the issue arises from the integration of the vulnerable external parser.