5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47345

CVE-2026-47345: TYPO3 HTML Sanitizer allows Cross-Site Scripting

Namespace attributes are not encoded correctly during HTML serialization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47345

CVE-2026-47345:

5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
typo3/html-sanitizer	composer	< 2.3.2	2.3.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security vulnerability is a cross-site scripting (XSS) issue within the typo3/html-sanitizer package, specifically affecting versions prior to 2.3.2. The root cause is the incorrect encoding of namespace attributes during the HTML serialization process. The analysis of the patch commit 8b5d0be44ded457ca993ec9ca93d859941c63764 reveals the exact location of the fix. The commit introduces a new method, namespaceAttrs, within the TYPO3\HtmlSanitizer\Serializer\Rules class in the file src/Serializer/Rules.php. This method is responsible for handling namespace attributes of a DOM element. The #[Override] attribute on the function indicates that it is overriding a method from a parent class, which likely contained the vulnerable logic. The patched code now correctly encodes the namespace attribute's value using $this->enc($nsNode->nodeValue, true) before it is written to the output. Before this patch, the absence of this encoding step allowed malicious code to be injected via crafted namespace attributes. Therefore, the namespaceAttrs function is the direct point of vulnerability, as it is the function that processes the malicious input. A runtime profiler would show TYPO3\HtmlSanitizer\Serializer\Rules::namespaceAttrs in the stack trace when the vulnerability is triggered.

Vulnerable functions

TYPO3\HtmlSanitizer\Serializer\Rules::namespaceAttrs

src/Serializer/Rules.php

The vulnerability is due to the improper encoding of namespace attributes during HTML serialization. The patch introduces the `namespaceAttrs` method in the `TYPO3\\HtmlSanitizer\\Serializer\\Rules` class to correctly handle this. This method, marked with `#[Override]`, replaces a presumably insecure implementation from a parent class. The vulnerable execution path would involve this method (or its parent's implementation before the patch), which failed to encode attribute values, allowing for XSS. The fix is the line `$this->wr(\' \')->wr($nsNode->nodeName)->wr(\'=\\"\\')->wr($this->enc($nsNode->nodeValue, true))->wr(\'\\"\\');`, which explicitly encodes the namespace value.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.