CVE-2026-71497 in jsoup
Summary
by MITRE • 08/07/2026
jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability in jsoup affects versions 1.14.3 through 1.23.1 and represents a parsing inconsistency that stems from improper handling of malformed HTML tag names containing control characters at their termination. This flaw specifically impacts the HTML parser's ability to correctly identify and process tag boundaries when control characters are present at the end of tag names, leading to incorrect semantic interpretation of elements during the parsing phase.
The technical implementation of this vulnerability occurs within jsoup's HTML parsing engine where the parser encounters a malformed tag name ending in a control character such as tab, newline, or other non-printable ASCII values. When processing these malformed tags, the parser fails to properly terminate the tag name and instead continues parsing, causing the tag to be misinterpreted as a different element type. This misinterpretation becomes particularly problematic when combined with custom Safelist configurations that permit certain raw-text elements such as script, style, or other markup-sensitive tags.
The operational impact of this vulnerability extends beyond simple parsing errors into serious security implications for web applications using jsoup for HTML sanitization and processing. When a custom Safelist permits raw-text elements and encounters malformed tags ending in control characters, the parser's incorrect behavior can cause content that should remain as literal text to be serialized as active markup. This transformation creates a potential cross-site scripting vector where attacker-controlled content could be injected into web pages through seemingly benign HTML processing operations.
This vulnerability aligns with CWE-1004 weakness category related to insecure default settings, specifically manifesting as improper handling of malformed input data that leads to unexpected behavior in security-sensitive contexts. The issue also maps to ATT&CK technique T1203 - Exploitation for Client Execution, as it enables attackers to potentially inject malicious markup through the parsing inconsistency, and T1566 - Phishing with Social Engineering, when combined with other techniques to craft malicious HTML content.
The security implications are particularly severe for applications that rely on jsoup's HTML sanitization capabilities for user-generated content processing, where custom Safelists are configured to permit specific element types. Applications using custom configurations that include raw-text elements in their permitted lists become vulnerable to this attack vector, as the misparsing can transform benign text into executable markup during serialization. The fix implemented in version 1.23.1 addresses the root cause by enforcing stricter tag name termination rules and improving control character handling within the parser's tokenization process.
Organizations should prioritize updating to jsoup version 1.23.1 or later to remediate this vulnerability, while also reviewing custom Safelist configurations to ensure they do not inadvertently permit raw-text elements that could be exploited through this parsing inconsistency. Security teams should conduct thorough testing of HTML processing workflows that utilize custom sanitization rules, particularly those involving user input handling, to verify that no similar vulnerabilities exist in their broader application ecosystems. The vulnerability demonstrates the critical importance of robust input validation and proper error handling in security-sensitive libraries, as seemingly minor parsing inconsistencies can have significant security implications when combined with application-specific configuration choices.