CVE-2026-71497: jsoup: Cleaner may expose markup with custom raw-text elements
jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1.
Other sources
jsoup: Cleaner may expose markup with custom raw-text elements
— Microsoft
When a custom Safelist permits certain raw-text elements, jsoup may incorrectly sanitize malformed HTML containing a tag name that ends in a control character. The tag may acquire the parsing behavior of a different element, causing content that should remain text to be emitted as active markup after serialization and potentially allowing XSS.
jsoup’s built-in Safelists are unaffected.
Patches
Upgrade to jsoup 1.23.1.
Workarounds
Until upgrading, do not permit raw-text elements in custom Safelists used to clean untrusted HTML.
Additional security considerations
This fix addresses malformed tag-name handling only.
Permitting raw-text elements in a custom Safelist does not make their contents inherently safe. For example, applications that permit style must apply appropriate CSS safeguards separately, because jsoup does not parse or sanitize CSS.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.jsoup:jsoupto a version that resolves this vulnerability.Fixed in 1.23.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.14.0-5 - Upgrade
Upgrade
jsoupto a version that resolves this vulnerability.Fixed in 1.23.1 - Configuration
Until upgrading, do not permit raw-text elements in custom Safelists used to clean untrusted HTML (misparsing may cause text to be emitted as active markup after serialization, potentially enabling XSS).
jsoup HTML Cleaner (custom Safelist) Permitting raw-text elements in a custom Safelist = false
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71497?
The severity of CVE-2026-71497 is rated as medium with a score of 4.7.
What type of attack is associated with CVE-2026-71497?
CVE-2026-71497 is associated with Cross-Site Scripting (XSS) vulnerabilities.
How does CVE-2026-71497 affect jsoup?
CVE-2026-71497 affects jsoup by allowing malformed HTML to be incorrectly sanitized, which may lead to active markup being emitted instead of plain text.
How can I mitigate CVE-2026-71497?
To mitigate CVE-2026-71497, ensure that your Safelist configuration does not unintentionally permit malformed HTML tags.
In which software is CVE-2026-71497 found?
CVE-2026-71497 is found in jsoup, a Java library used for working with real-world HTML.