--- title: "TYPO3-CORE-SA-2019-021: Cross-Site Scripting in Form Framework validation handling" url: "https://news.typo3.com/security/advisory/typo3-core-sa-2019-021" description: It has been discovered that TYPO3 CMS is vulnerable to cross-site scripting. image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg" date: 2026-06-11 modified: 2026-06-11 categories: - "Developer & Technology" - TYPO3 CMS --- # TYPO3-CORE-SA-2019-021: Cross-Site Scripting in Form Framework validation handling - [Developer & Technology](https://news.typo3.com/article/category/developer-technology) - Security / [TYPO3 CMS](https://news.typo3.com/article/category/security/typo3-cms) TYPO3-CORE-SA-2019-021: Cross-Site Scripting in Form Framework validation handling ================================================================================== 17 December 2019 ![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp) It has been discovered that TYPO3 CMS is vulnerable to cross-site scripting. - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/959dc9d08a56cfd6673539bd9f05668f.jpeg)[Frank Nägler](https://news.typo3.com/article/author/frank-naegler) - **Component Type:** TYPO3 CMS - **Subcomponent:** Form Framework (ext:form) - **Release Date:** December 17, 2019 - **Vulnerability Type:** Cross-Site Scripting - **Affected Versions:** 8.0.0-8.7.29 and 9.0.0-9.5.11 and 10.0.0-10.2.0 - **Severity:** Medium - **Suggested CVSS v3.1:** [AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C&version=3.1) - **CVE:** not assigned yet ### Problem Description It has been discovered that the output of field validation errors in the Form Framework is vulnerable to cross-site scripting. ### Solution Update to TYPO3 versions 8.7.30 or 9.5.12 or 10.2.2 that fix the problem described. ### Credits Thanks to Aslam Idrisov and an anonymous contributor who reported this issue and to TYPO3 framework merger Frank Nägler who fixed the issue. ### General Advice Follow the recommendations that are given in the [TYPO3 Security Guide](https://docs.typo3.org/typo3cms/CoreApiReference/Security/Index.html#security). Please subscribe to the [typo3-announce](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce) mailing list. ### General Note All security related code changes are tagged so that you can easily look them up in our [review system](https://review.typo3.org/#/q/status:merged+project:Packages/TYPO3.CMS+topic:security,n,z). ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/ff0e021ae96ab661b7b17352d9700a91.jpeg) About the Author [Frank Nägler](https://news.typo3.com/article/author/frank-naegler) CTO @ TYPO3 GmbH,Hamburg, Germany [Website](https://typo3.com)[LinkedIn](https://www.linkedin.com/in/franknaegler/)[Xing](https://www.xing.com/profile/Frank_Naegler) Frank loves solving hard problems with code, enjoys building cool stuff, and works as CTO for TYPO3 GmbH. He's been developing the TYPO3 CMS core since October 2014 and programming professionally since 2000. When he first started with TYPO3, version 3.6 was still in place. In his spare time, he enjoys playing golf and flying drones and has been an active member of the German Red Cross (GRC) for over 30 years. Frank regularly writes about TYPO3, PHP, Open Source Governance, and AI. [More posts by this author](https://news.typo3.com/article/author/frank-naegler)