The vulnerability arises from improper neutralization of input during web page generation in the TYPO3 HTML Sanitizer. Specifically, when ALLOW_INSECURE_RAW_TEXT is enabled, the sanitizer fails to recognize closing tags that include whitespace variants, such as </style\t>. Browsers interpret these as valid end tags, allowing subsequent content to bypass the sanitization process. This flaw enables attackers to circumvent the cross-site scripting prevention mechanism in TYPO3 HTML Sanitizer versions prior to 2.3.2. The CVSS 4.0 base score is 2.1, indicating low severity, with network attack vector, low complexity, and partial user interaction required.

This vulnerability allows an attacker to bypass the XSS prevention mechanism in TYPO3 HTML Sanitizer when ALLOW_INSECURE_RAW_TEXT is enabled, potentially leading to cross-site scripting attacks. However, the impact is limited by the low CVSS score and the requirement for partial user interaction and low privileges. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should avoid enabling ALLOW_INSECURE_RAW_TEXT until a fix is available. Monitor TYPO3 vendor advisories for updates and apply any official fixes promptly once released.