GHSA-95qm-3xp7-vfj5: TYPO3 Cross-Site Scripting in Form Framework validation handling

The vulnerability stems from improper output encoding in form validation error handling. TYPO3's Form Framework uses ValidationResultsViewHelper to display errors and AbstractElementRenderer for element-level error rendering. Both components process user-controlled validation messages but failed to apply context-aware escaping before including them in HTML output. This matches the XSS pattern described in CWE-79 and aligns with TYPO3's architecture where ViewHelpers and Renderers handle frontend output generation. The high confidence comes from the direct correlation between these components' responsibilities and the vulnerability description's focus on validation error output.