[GHSA-22q7-cg4r-p9mx] TYPO3 Cross-Site Scripting in Fluid ViewHelpers#8011
Open
RainSignal wants to merge 1 commit into
Open
[GHSA-22q7-cg4r-p9mx] TYPO3 Cross-Site Scripting in Fluid ViewHelpers#8011RainSignal wants to merge 1 commit into
RainSignal wants to merge 1 commit into
Conversation
Copilot stopped work on behalf of
RainSignal due to an error
June 11, 2026 14:31
github-actions
Bot
changed the base branch from
main
to
RainSignal/advisory-improvement-8011
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates
Comments
The affected package is incorrectly listed as typo3/cms-core.
The vulnerability exists in typo3/cms-fluid, specifically in three
ViewHelpers: HtmlentitiesViewHelper, StripTagsViewHelper, and
UrlencodeViewHelper. These ViewHelpers failed to encode objects
implementing __toString() before output, and HtmlentitiesViewHelper
used ENT_COMPAT instead of ENT_QUOTES, leaving single quotes unencoded.
This was verified by reviewing the security commit in the
TYPO3-CMS/fluid repository:
TYPO3-CMS/fluid@v8.7.22...v8.7.23
TYPO3-CMS/fluid@v9.5.3...v9.5.4
typo3/cms-core and typo3/cms-fluid are independent Composer packages.
Listing cms-core as affected may mislead users into upgrading the wrong
package.