--- title: About the Latest TYPO3 Core Security Release url: "https://news.typo3.com/article/about-the-latest-typo3-core-security-release" description: The security releases published on Tuesday, August 10, 2021, contained a very important security bug fix. It removes malicious and incorrect HTML from rich-text-enabled fields. However, it has also caused problems for a number of sites. image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg" date: 2026-06-11 modified: 2026-06-11 categories: - "Developer & Technology" - "Product Updates & Roadmap" --- # About the Latest TYPO3 Core Security Release - [Developer & Technology](https://news.typo3.com/article/category/developer-technology) - [Product Updates & Roadmap](https://news.typo3.com/article/category/product-updates-roadmap) About the Latest TYPO3 Core Security Release ============================================ 14 August 2021 ![](https://news.typo3.com/fileadmin/_processed_/3/0/csm_html-sanitizer-commit_d548dd3ecf.webp) The security releases published on Tuesday, August 10, 2021, contained a very important security bug fix. It removes malicious and incorrect HTML from rich-text-enabled fields. However, it has also caused problems for a number of sites. - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/b8266fdc667b773926c59081862ab148.jpeg)[Oliver Hader](https://news.typo3.com/article/author/oliver-hader) - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/860e9e538aa963a3600a2488dff48070.jpeg)[Benni Mack](https://news.typo3.com/article/author/benni-mack) We in the TYPO3 [Core Team](https://typo3.com/content-playground/page-templates-1) and Security Team were happy that the release had finally solved this long-standing, severe issue with a bullet-proof solution. But maybe it was too bullet-proof? We were soon contacted by people from around the TYPO3 community who told us about situations where the sanitizer cleaned up too much or in the wrong places. In this article we look at what the security release is fixing, what is causing the issues, and how to solve them. ![](https://news.typo3.com/fileadmin/_processed_/9/4/csm_rich-text-editor-exampe_f9c581c5d8.webp) What Is a Rich-Text-Enabled Field? ------------------------------------ Also called *RTE content*, a *Rich-Text-Enabled Field* is a field where editors can add formatting, links, tables, etc. You will probably recognize it as the most prominent text field in the *Text* or *Text w/ Media* content elements. What Was the Security Issue? ------------------------------ Rich-text-enabled fields format text using HTML code, and without sanitation it would be possible to use it to insert malicious code on a page. This is similar to other kinds of User-Submitted Content, such as fields in feedback forms, where the submitted information is displayed again as a preview before sending out the email and storing it into the database. Prior to the security release, TYPO3 used a *deny list* concept called *RemoveBadXSS*. It is not a safe solution because it didn’t parse the HTML, but simply used regular expressions to search for malicious HTML. How Was it Fixed? ------------------- We implemented a sanitizing parser as a separate PHP package called [*typo3/html-sanitizer*](https://github.com/TYPO3/html-sanitizer). It is a parser based on an *allow list* instead of a *deny list*. The goal of the HTML Sanitizer is to remove unwanted HTML code that could lead to [cross-site scripting (XSS)](https://en.wikipedia.org/wiki/Cross-site_scripting), a common and serious security vulnerability. Cross-site scripting attacks can make use of other security holes, so an editor can potentially add malicious HTML code, even without knowing it. This is why sanitizing submitted HTML is so important. We have been looking for a good and performant solution for more than eight years, but never found a flexible, fast, and well-maintained package until now. We implemented a default allow list for the HTML Sanitizer and then put it to use in two places: - **When a backend user saves RTE content to the database.** We used to rely on CKEditor's sanitization logic, but it is using client-side validation that cannot always be trusted. This is now cleaned up and moved to the server side. On every save the incoming HTML is sanitized. A global feature flag “rte.htmlSanitize” was added and enabled by default. - **When rendering HTML content from an RTE field on the website**, the so-called *parseFunc* logic will also invoke the HTML sanitizer. parseFunc  is used to re-write HTML tags (e.g. TYPO3’s internal links to pages), and it is also used in the ** ViewHelper. What Are the Issues? ---------------------- ### 1. The Allow List of the HTML Sanitizer Contained Bugs Most of the issues reported were related to extended [CKEditor](https://ckeditor.com) plugins, or the fact that we did not consider having tests for *[spamProtectEmailAddresses](https://forge.typo3.org/issues/94904)* (which you can and should disable in 2021, as most bots can deal with this "obscure" logic). Thanks to all the reports, we could quickly resolve these. ### 2. People Used parseFunc in places where they shouldn't *lib.parseFunc* was in our opinion a feature to parse RTE content, but people used *[](https://docs.typo3.org/other/typo3/view-helper-reference/10.4/en-us/typo3/fluid/latest/Format/Html.html)* and *[parseFunc](https://docs.typo3.org/m/typo3/reference-typoscript/10.4/en-us/Functions/Parsefunc.html)* for a lot of other innovative solutions. You can use *parseFunc* to: - Replace and HTML tag (e.g. ** with**). - Add default CSS classes to all table cell elements. - Add custom tags after each
tag. In fact, *lib.parseFunc* can be used for any HTML-replacing logic, even though we have other solutions, such as TypoScript’s *[replacement](https://docs.typo3.org/m/typo3/reference-typoscript/10.4/en-us/Functions/Replacement.html)* option. There are truly a thousand ways to solve a single thing in TYPO3! We had several remote sessions with users who were affected and who struggled with the new behavior. These sessions provided important and helpful insights into use cases and requirements. The following list gives an overview of what happened so far: - [Troubleshooting & technical details collection](https://twitter.com/ohader/status/1425475911755911168) - [Tracking ticket for bug reports and corresponding pull-requests](https://forge.typo3.org/issues/94787) - [**Pull-request to relax the sanitization behavior.**](https://review.typo3.org/q/I4aee54d712ce4758f6c9c2e64a43f80b6c076406) We really need feedback & more tests by the community. Solutions Are Coming—Testers Needed ------------------------------------- **We are planning a regression bugfix release** (11.3.3, 10.4.20, 9.5.30) as soon as possible, once enough people have [reviewed our proposed changes](https://review.typo3.org/q/I4aee54d712ce4758f6c9c2e64a43f80b6c076406). **We will also ship a new ViewHelper** for Fluid: **. It can be used if people just want to make sure that it is safe to re-render user-submitted content. We are aware that only a small group of people can test the security bug fixes before the release, especially in real-life projects with lots of custom setup code. **We are actively looking for developers and companies, willing to help us** test security changes before they are released. Please reach out to if you would like to help us test changes before they are released. **We need contributions to write documentation on best practices**, for example how to choose the right ViewHelper for a given situation, and how to structure and separate data in templates in a better way. Conclusion ------------ We are sorry for the trouble the security release caused for many of you, but we're also very grateful to everybody who helped by contributing and providing feedback. You have made TYPO3 stronger than ever. ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/cc7cba9757f98fbe05023a139119df74.jpeg) About the Author [Oliver Hader](https://news.typo3.com/article/author/oliver-hader) Core Developer at TYPO3 GmbH,Hof, Germany [Website](https://typo3.com)[Twitter](https://twitter.com/ohader)[LinkedIn](https://www.linkedin.com/in/oliverhader/)[Xing](https://www.xing.com/profile/Oliver_Hader) Oliver started to work with TYPO3 in 2005 and was fascinated by the product and its universe. Since 2007 he is member of the TYPO3 Core Team. After going back to university in 2014 for achieving a postgraduate master degree in internet web science, he is now researching on advanced web technology topics in general and for TYPO3 in particular. In his spare time, Oliver loves to go cycling cross-country in the uplands around Hof (Germany) in northern Bavaria - at the region where he's living as well. [More posts by this author](https://news.typo3.com/article/author/oliver-hader) ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/d2f68d86720b93361f6910922465f559.jpeg) About the Author [Benni Mack](https://news.typo3.com/article/author/benni-mack) CTO at b13,Stuttgart, Germany [Website](https://b13.com/)[Twitter](https://twitter.com/bennimack)[LinkedIn](https://www.linkedin.com/in/benjaminmack/) Being the CTO at b13 GmbH, Benni is the TYPO3 Core Project Lead and one of the driving forces behind the TYPO3 community in the last years. [More posts by this author](https://news.typo3.com/article/author/benni-mack) Additional contributors ----------------------- - Copy Editor - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/d2606120ccc43c7846fe40337be2bc1e.png)Mathias Bolt Lesniak