---
title: "Breaking: #96831 - Enforce HTML sanitizer during frontend rendering"
manual: "TYPO3 Core Changelog"
version: "main"
permalink: "https://docs.typo3.org/permalink/changelog:breaking-96831"
source: "Changelog/12.0/Breaking-96831-EnforceHTMLSanitizerDuringFrontendRendering.rst"
typo3-version: "12.0"
typo3-major: 12
type: "breaking"
issue: 96831
forge: "https://forge.typo3.org/issues/96831"
tags: ["Frontend", "TypoScript", "NotScanned", "ext:frontend"]
rendered: "2026-09-20T18:31:11+00:00"
---

# Breaking: #96831 - Enforce HTML sanitizer during frontend rendering {#breaking-96831}

See [forge#96831](https://forge.typo3.org/issues/96831)

## Description {#description}

TYPO3 security fix [TYPO3-CORE-SA-2021-013](https://typo3.org/security/advisory/typo3-core-sa-2021-013)
introduced Composer package `typo3/html-sanitizer` to mitigate cross-site scripting vulnerabilities in
rich-text content. In order to relax the strict invocation, a corresponding feature flag has been added
in a follow-up release - which only was a temporary solution.

The feature flag `security.frontend.htmlSanitizeParseFuncDefault` is dropped, and content processing via
TypoScript `stdWrap.parseFunc` now enables HTML sanitization per default in case it has not been
disabled explicitly in corresponding invocation.

Sites that used a version prior to TYPO3 v12.0 received a corresponding deprecation message already.

## Impact {#impact}

Rich-text content processed with TypoScript `stdWrap.parseFunc` is HTML sanitized per default.
Feature flag `security.frontend.htmlSanitizeParseFuncDefault` does not have any effect anymore.

## Affected Installations {#affected-installations}

All scenarios that use TypoScript `stdWrap.parseFunc`, a direct invocation via PHP of
`\TYPO3\CMS\Frontend\ContentObject\ContentObjectRenderer::parseFunc()` or Fluid
view-helper `<f:format.html>`.

## Migration {#migration}

The following documents already tackled and described the scenario and implications:

-   [9.5.x: Important: #94484 - Introduce HTML Sanitizer](https://docs.typo3.org/permalink/changelog:important-94484)
-   [12.0: Breaking: #96520 - Enforce non-empty configuration in cObj::parseFunc](https://docs.typo3.org/permalink/changelog:breaking-96520)