Namespace attributes are not encoded correctly during HTML serialization. This allows bypassing the cross-site scripting prevention mechanism of `typo3/html-sanitizer` before version 2.3.2.

Credits to Doyensec in collaboration with Claude and Anthropic Research for reporting this vulnerability.