Cross-Site Scripting Vulnerability in jsoup Library by Jhy
CVE-2026-71497

4.7MEDIUM

Key Information:

Vendor

Jhy

Status
Jsoup
Vendor
CVE Published:
6 August 2026

What is CVE-2026-71497?

A vulnerability exists within the jsoup HTML parser that can incorrectly handle malformed tag names ending in a control character. This flaw allows a custom Safelist to misinterpret inert text as active markup, which can lead to cross-site scripting (XSS) attacks. Notably, this issue only affects specific versions between 1.14.3 and 1.23.0, while the built-in Safelists remain unaffected. The vulnerability has been addressed in version 1.23.1, which includes fixes to prevent such parsing errors.

Affected Version(s)

jsoup >= 1.14.3, < 1.23.1

References

https://github.com/jhy/jsoup/security/advisories/GHSA-pmh...
x_refsource_CONFIRM
https://github.com/jhy/jsoup/issues/2538
x_refsource_MISC
https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d...
x_refsource_MISC

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.