This vulnerability involves improper neutralization of input during web page generation (CWE-79) in the TYPO3 HTML Sanitizer. Specifically, namespace attributes are not encoded correctly during HTML serialization, which enables attackers to circumvent the sanitizer's protections against cross-site scripting attacks. The flaw affects TYPO3 HTML Sanitizer versions prior to 2.3.2. The CVSS 4.0 base score is 5.1, indicating a medium severity with network attack vector, low complexity, and requiring low privileges and user interaction.

Successful exploitation could allow an attacker to inject malicious scripts into web pages processed by the vulnerable TYPO3 HTML Sanitizer, potentially leading to cross-site scripting attacks. This can result in unauthorized script execution in the context of affected users. However, no known exploits have been reported in the wild, and the impact is limited to scenarios where the sanitizer is used and the vulnerability is triggered.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor TYPO3 advisories for updates. Until a patch is available, consider applying additional input validation or output encoding controls where feasible to mitigate potential exploitation.