It has been discovered that link tags generated by typolink functionality are vulnerable to cross-site scripting - properties being assigned as HTML attributes have not been parsed correctly.
Update to TYPO3 versions 9.5.17 or 10.4.2 that fix the problem described.
{
"nvd_published_at": null,
"severity": "MODERATE",
"cwe_ids": [
"CWE-79"
],
"github_reviewed_at": "2020-05-13T23:05:48Z",
"github_reviewed": true
}