The flaw lies in the HTML serializer of TYPO3's HTML Sanitizer, which fails to properly encode namespace attributes. This omission allows an attacker to craft malicious markup that bypasses the package’s XSS prevention, letting injected scripts execute in the context of any user viewing the sanitized content.

Vendors and users employing TYPO3 HTML Sanitizer versions earlier than 2.3.2 are vulnerable. The issue affects all instances where the sanitized output is rendered without additional filtering.

With a CVSS score of 5.1 the risk is moderate; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply crafted content—such as custom templates or user‑generated input—to the sanitizer; successful exploitation would result in malicious script execution in victims’ browsers, potentially leading to session hijacking or data theft.