GHSA-8m6j-p5jv-v69w: TYPO3 Cross-Site Scripting in Online Media Asset Rendering

The vulnerability stems from improper encoding in URL construction and HTML attribute generation. The patch diff shows critical changes: 1) Replacing urlencode() with rawurlencode() in OEmbed URL construction, 2) Adding htmlspecialchars() encoding in iframe src attributes, 3) Introducing proper attribute escaping via implodeAttributes(). The vulnerable functions directly handled user-controlled video IDs and URL parameters without sufficient encoding, enabling XSS when malicious content was injected into YouTube/Vimeo media identifiers. The high confidence comes from clear pre-patch absence of encoding and post-patch security-focused encoding additions.