VYPR
← All advisories
Moderate severityNVD Advisory· Published Nov 14, 2023· Updated Aug 29, 2024

By-passing Cross-Site Scripting Protection in HTML Sanitizer

CVE-2023-47125

Description

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vulnerability has been addressed in versions 1.5.3 and 2.1.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

TYPO3 HTML sanitizer fails to handle DOM processing instructions, allowing XSS bypass; patched in versions 1.5.3 and 2.1.4.

Vulnerability

Description

The TYPO3 HTML sanitizer library (typo3/html-sanitizer) contains a flaw in how it processes DOM processing instructions like <?xml ?>. The sanitizer did not encode or remove these nodes, allowing an attacker to inject arbitrary markup that bypasses the cross-site scripting (XSS) protection mechanisms [1][4]. This issue affects TYPO3 CMS versions from 8.7.42 to 8.7.54, 9.5.29 to 9.5.43, 10.4.19 to 10.4.40, 11.3.2 to 11.5.32, and 12.0.0 to 12.4.7, as well as the standalone library before versions 1.5.3 and 2.1.4.

Exploitation

An attacker can exploit this vulnerability by crafting input that includes a processing instruction (e.g., <?xml ?>) containing malicious JavaScript or HTML. When this input is processed by the sanitizer, the processing instruction is not handled correctly and may be output as-is, allowing the attacker to inject script code into a web page. The attack requires user interaction (e.g., clicking a link) and is somewhat complex to exploit, but does not require authentication [1][4].

Impact

Successful exploitation leads to cross-site scripting (XSS), where an attacker can execute arbitrary JavaScript in the context of a victim's browser session. This could be used to steal session cookies, redirect users to malicious sites, or deface the page. The CVSS v3.1 score is 5.4 (Medium), with vector AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N [4].

Mitigation

The vulnerability has been patched in TYPO3 HTML sanitizer versions 1.5.3 and 2.1.4, and in TYPO3 CMS versions 8.7.55 ELTS, 9.5.44 ELTS, 10.4.41 ELTS, 11.5.33, and 12.4.8 [1][3][4]. Users should upgrade to these versions immediately, as no workarounds are available.

References
  1. NVD - CVE-2023-47125
  2. [SECURITY] Deny processing instructions · TYPO3/html-sanitizer@b8f9071
  3. By-passing Cross-Site Scripting Protection in HTML Sanitizer

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
typo3/html-sanitizerPackagist
>= 1.0.0, < 1.5.31.5.3
typo3/html-sanitizerPackagist
>= 2.0.0, < 2.1.42.1.4

Affected products

3

Patches

1
b8f90717251d

[SECURITY] Deny processing instructions

https://github.com/TYPO3/html-sanitizerOliver HaderSep 21, 2023via ghsa
commit
4 files changed · +33 −1
  • src/Behavior.php+10 −0 modified
    @@ -62,6 +62,11 @@ class Behavior
      */
     public const ENCODE_INVALID_CDATA_SECTION = 32;
 
+    /**
+     * in case an unexpected processing instruction (e.g. `<?xml>`) was found, encode the whole node as HTML
+     */
+    public const ENCODE_INVALID_PROCESSING_INSTRUCTION = 64;
+
     /**
      * @var int
      */
@@ -224,6 +229,11 @@ public function shallEncodeInvalidCdataSection(): bool
         return ($this->flags & self::ENCODE_INVALID_CDATA_SECTION) === self::ENCODE_INVALID_CDATA_SECTION;
     }
 
+    public function shallEncodeInvalidProcessingInstruction(): bool
+    {
+        return ($this->flags & self::ENCODE_INVALID_PROCESSING_INSTRUCTION) === self::ENCODE_INVALID_PROCESSING_INSTRUCTION;
+    }
+
     public function shallRemoveUnexpectedChildren(): bool
     {
         return ($this->flags & self::REMOVE_UNEXPECTED_CHILDREN) === self::REMOVE_UNEXPECTED_CHILDREN;
  • src/Builder/CommonBuilder.php+5 −1 modified
    @@ -76,7 +76,11 @@ public function build(): Sanitizer
     protected function createBehavior(): Behavior
     {
         return (new Behavior())
-            ->withFlags(Behavior::ENCODE_INVALID_TAG | Behavior::REMOVE_UNEXPECTED_CHILDREN)
+            ->withFlags(
+                Behavior::ENCODE_INVALID_TAG
+                | Behavior::REMOVE_UNEXPECTED_CHILDREN
+                | Behavior::ENCODE_INVALID_PROCESSING_INSTRUCTION
+            )
             ->withName('common')
             ->withTags(...array_values($this->createBasicTags()))
             ->withTags(...array_values($this->createMediaTags()))
  • src/Visitor/CommonVisitor.php+6 −0 modified
    @@ -19,6 +19,7 @@
 use DOMComment;
 use DOMElement;
 use DOMNode;
+use DOMProcessingInstruction;
 use DOMText;
 use Psr\Log\LoggerAwareInterface;
 use Psr\Log\LoggerAwareTrait;
@@ -64,6 +65,10 @@ public function beforeTraverse(Context $context): void
 
     public function enterNode(DOMNode $domNode): ?DOMNode
     {
+        if ($domNode instanceof DOMProcessingInstruction) {
+            return $this->handleInvalidNode($domNode);
+        }
+
         if (!$domNode instanceof DOMCdataSection
             && !$domNode instanceof DOMComment
             && !$domNode instanceof DOMElement
@@ -219,6 +224,7 @@ protected function handleInvalidNode(DOMNode $domNode): ?DOMNode
         if (
             ($domNode instanceof DOMComment && $this->behavior->shallEncodeInvalidComment())
             || ($domNode instanceof DOMCdataSection && $this->behavior->shallEncodeInvalidCdataSection())
+            || ($domNode instanceof DOMProcessingInstruction && $this->behavior->shallEncodeInvalidProcessingInstruction())
         ) {
             $this->log('Found unexpected node {nodeName}', [
                 'behavior' => $this->behavior->getName(),
  • tests/CommonBuilderTest.php+12 −0 modified
    @@ -263,6 +263,14 @@ public function isSanitizedDataProvider(): array
                 '<!-- &lt;&quot;comment&quot;&gt; -->',
                 '<!-- &lt;&quot;comment&quot;&gt; -->',
             ],
+            '#912' => [
+                '<!---><p>',
+                '<!---&gt;&lt;p&gt;-->',
+            ],
+            '#913' => [
+                '<!---!><p>',
+                '<!---!&gt;&lt;p&gt;-->',
+            ],
             '#915' => [
                 '#text',
                 '#text',
@@ -303,6 +311,10 @@ public function isSanitizedDataProvider(): array
                 '<p class="{&quot;json&quot;:true}">value</p>',
                 '<p class="{&quot;json&quot;:true}">value</p>',
             ],
+            '#941' => [
+                '<?xml >s<img src=x onerror=alert(1)> ?>',
+                '&lt;?xml &gt;s&lt;img src=x onerror=alert(1)&gt; ?&gt;',
+            ],
         ];
     }

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.