VYPR
← All advisories
Medium severity4.7NVD Advisory· Published Aug 6, 2026· Updated Sep 10, 2026

CVE-2026-71497

CVE-2026-71497

Description

jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.jsoup:jsoupMaven
>= 1.14.3, < 1.23.11.23.1

Affected products

56

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.