Cross-Site Scripting (XSS) in org.jsoup:jsoup (CVE-2026-71497)
Summary
Cross-site scripting in org.jsoup:jsoup (CVE-2026-71497). Risk of unauthorized operations or information disclosure. Exploitable via Safelist. Mitigation: upgrade to 1.23.1 or later.
Original description
The description as published by the source.
When a custom Safelist permits certain raw-text elements, jsoup may incorrectly sanitize malformed HTML containing a tag name that ends in a control character. The tag may acquire the parsing behavior of a different element, causing content that should remain text to be emitted as active markup after serialization and potentially allowing XSS.
jsoup’s built-in Safelists are unaffected.
Patches
Upgrade to jsoup 1.23.1.
Workarounds
Until upgrading, do not permit raw-text elements in custom Safelists used to clean untrusted HTML.
Additional security considerations
This fix addresses malformed tag-name handling only.
Permitting raw-text elements in a custom Safelist does not make their contents inherently safe. For example, applications that permit style must apply appropriate CSS safeguards separately, because jsoup does not parse or sanitize CSS.
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-71497 has been found in org.jsoup:jsoup.
Attackers can target a specific entry point like Safelist over the network to misuse the product.
Risk of unauthorized operations or information disclosure. CVSS score: 4.7/10.
What to do: upgrade org.jsoup:jsoup to 1.23.1 or later.
If unsure, ask your IT team or search "org.jsoup:jsoup CVE-2026-71497" on the vendor's site.
CVE-2026-71497 (org.jsoup:jsoup) — CWE-79 / CVSS v3 4.7
Attack vector: remote (network-reachable) / unauthenticated
Attack surface: Safelist / style
Patched: 1.23.1 — apply immediately
Workaround: Until upgrading, do not permit raw-text elements in custom Safelists used to clean untrusted HTML.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
Cross-site scripting (XSS) (CWE-79) exists in org.jsoup:jsoup. Attackers reach the vulnerable code path via Safelist without authentication.
Check the vendor advisory for the affected versions of org.jsoup:jsoup. Attack surface: Safelist / style.
Severity: Medium (CVSS 4.7/10). Risk of unauthorized operations or information disclosure.
Update to 1.23.1.
Workaround: Until upgrading, do not permit raw-text elements in custom Safelists used to clean untrusted HTML.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Audit SBOM/dependencies to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
Audit SBOM/dependencies for affected components.資産台帳・SBOM・依存マニフェストで org.jsoup:jsoup を使っているサービスとバージョンを洗い出す。
-
2Apply temporary workaround mitigate
Until upgrading, do not permit raw-text elements in custom Safelists used to clean untrusted HTML.パッチが適用されるまでの応急処置として、Until upgrading, do not permit raw-text elements in custom Safelists used to clean untrusted HTML. を実施。回避策の副作用 (機能低下) を確認した上で。
-
3Apply patch patch
Upgrade org.jsoup:jsoup to 1.23.1ステージング環境で 1.23.1 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
4Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-71497 jsoup
- Ubuntu UBUNTU-CVE-2026-71497 jsoup