typo3/html-sanitizer

HTML sanitizer aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values.

Latest v2.3.2

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

100

Are you affected? Scan for Free

Health Score Breakdown

Repo commit activity

No commits and no active maintainers were observed during the last three months. This is partly offset by the recent release, but it still indicates a current maintenance slowdown.

Repo tooling

Composer build tooling is present, but no security-scanning tool was detected. The security policy and recent security-focused release notes provide some compensation.

Workflow audit

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings. Both of its action references are unpinned, leaving a modest supply-chain hygiene gap.

Vulnerabilities

Title	Versions	Severity
CVE-2026-47345 typo3/html-sanitizer is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 2.3.2.	0.0.0 - 2.3.2	Medium
CVE-2026-47344 typo3/html-sanitizer is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 2.3.2.	0.0.0 - 2.3.2	Low
CVE-2023-47125 typo3/html-sanitizer is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 1.0.0 - 1.5.2 and 2.0.0 - 2.1.3.	1.0.0 - 1.5.22.0.0 - 2.1.3	Medium
CVE-2023-38500 typo3/html-sanitizer is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 1.0.0 - 1.5.1 and 2.0.0 - 2.1.2.	1.0.0 - 1.5.12.0.0 - 2.1.2	Medium
CVE-2022-23499 typo3/html-sanitizer is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 1.0.0 - 1.5.0 and 2.0.0 - 2.1.1.	1.0.0 - 1.5.02.0.0 - 2.1.1	Medium