GHSA-47m6-46mj-p235 TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection

• Packagist typo3/html-sanitizer: >= 1.0.0, < 1.0.7 → fixed in 1.0.7 • Packagist typo3/html-sanitizer: >= 2.0.0, < 2.0.16 → fixed in 2.0.16 • Packagist typo3/cms-core: >= 10.0.0, < 10.4.32 → fixed in 10.4.32 • Packagist typo3/cms-core: >= 11.0.0, < 11.5.16 → fixed in 11.5.16 • Packagist typo3/cms: >= 10.0.0, < 10.4.32 → fixed in 10.4.32 • Packagist typo3/cms: >= 11.0.0, < 11.5.16 → fixed in 11.5.16

> ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (5.7) Problem Due to a parsing issue in upstream package `masterminds/html5`, malicious markup used in a sequence with special HTML comments cannot be filtered and sanitized. This allows to by-pass the cross-site scripting mechanism of `typo3/html-sanitizer`. Solution Update to `typo3/html-sanitizer` versions 1.0.7 or 2.0.16 that fix the problem described. Credits Thanks to David Klein who reported this issue, and to TYPO3 security team member Oliver Hader who fixed the issue.