CVE-2022-36020

mediumpriority · track · 24EPSS 0.008 · 57 %ileEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.82% (57th) EPSS

CVSS 6.1 · medium

Is it mine?

10 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · osv

EPSS · scored 2026-10-27

The typo3/html-sanitizer package is an HTML sanitizer, written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. Due to a parsing issue in the upstream package `masterminds/html5`, malicious markup used in a sequence with special HTML comments cannot be filtered and sanitized. This allows for a bypass of the cross-site scripting mechanism of `typo3/html-sanitizer`. This issue has been addressed in versions 1.0.7 and 2.0.16 of the `typo3/html-sanitizer` package. Users are advised to upgrade. There are no known workarounds for this issue.

cvss

Technical severity, 0–10. One row per scoring source.

6.1

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 2.7

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · ENISA EU

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · security-advisories@github.comexploitability 2.8 · impact 2.7

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · OSV

v3.15.6mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-79USCWE-79US

affected products (10)

Products and version ranges known to be affected.

TYPO3 html-sanitizer1.0.0, → 1.0.7enisa_euvdEU
TYPO3 html-sanitizer2.0.0, → 2.0.16enisa_euvdEU
typo3 html sanitizer1.0.0 → 1.0.7nvdUScpe:2.3:a:typo3:html_sanitizer:*:*:*:*:*:*:*:*
typo3 html sanitizer2.0.0 → 2.0.16nvdUScpe:2.3:a:typo3:html_sanitizer:*:*:*:*:*:*:*:*
Packagist typo3/cms10.0.0 → 10.4.32osvUSpkg:composer/typo3/cms
Packagist typo3/cms11.0.0 → 11.5.16osvUSpkg:composer/typo3/cms
Packagist typo3/cms-core10.0.0 → 10.4.32osvUSpkg:composer/typo3/cms-core
Packagist typo3/cms-core11.0.0 → 11.5.16osvUSpkg:composer/typo3/cms-core
Packagist typo3/html-sanitizer1.0.0 → 1.0.7osvUSpkg:composer/typo3/html-sanitizer
Packagist typo3/html-sanitizer2.0.0 → 2.0.16osvUSpkg:composer/typo3/html-sanitizer

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-47m6-46mj-p235TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection2022-09-16ghsa · osvUS
> ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (5.7) ### Problem Due to a parsing issue in upstream package [`masterminds/html5`](https://packagist.org/packages/masterminds/html5), malicious markup used in a sequence with special HTML comments cannot be filtered and sanitized. This allows to by-pass the cross-site scripting mechanism of `typo3/html-sanitizer`. ### Solution Update to `typo3/html-sanitizer` versions 1.0.7 or 2.0.16 that fix the problem described. ### Credits Thanks to David Klein who reported this issue, and to TYPO3 security team member Oliver Hader who fixed the issue.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd osv NVD CVE.org MITRE

published 2022-09-13modified 2026-06-17

references (14)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan