CVE-2026-71497

Received Received - Intake

Cross-Site Scripting in jsoup HTML Parser

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-71497

Affected Vendors & Products

Vendor	Product	Version / Range
jsoup	jsoup	From 1.14.3 (inc) to 1.23.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

jsoup versions 1.14.3 to 1.23.1 contain a flaw where a malformed tag name ending in a control character causes the parser to misinterpret the tag as a different element. If a custom Safelist allows raw-text elements, this can lead to malicious content being rendered as active markup after serialization, enabling cross-site scripting (XSS). Built-in Safelists are unaffected.

Detection Guidance

This vulnerability can be detected by checking the version of jsoup in use. If your system uses jsoup between versions 1.14.3 and 1.23.0, it is vulnerable. Run commands like 'mvn dependency:tree' for Maven projects or 'gradle dependencies' for Gradle projects to check the jsoup version.

Impact Analysis

This vulnerability could allow attackers to inject malicious scripts into web pages processed by jsoup. If your application uses a custom Safelist permitting raw-text elements, it may render user-controlled input as executable code, leading to XSS attacks that compromise user sessions or steal data.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements for protected health information. Organizations using affected jsoup versions may face compliance risks if exploited.

Mitigation Strategies

Upgrade jsoup to version 1.23.1 or later immediately. If using a dependency manager like Maven or Gradle, update the version in your project configuration and rebuild. Review any custom Safelist configurations to ensure they do not permit raw-text elements that could be exploited.

Hi! I’m here to help you understand CVE-2026-71497. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70