{"id":"CVE-2026-71497","summary":"jsoup: Cleaner may expose markup with custom raw-text elements","details":"jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1.","aliases":["GHSA-pmhh-3w7g-xqp8"],"modified":"2026-08-09T08:05:13.506241Z","published":"2026-08-06T21:09:31.489Z","related":["CGA-ph39-whqg-g86m"],"database_specific":{"cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71497.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71497.json"},{"type":"ADVISORY","url":"https://github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71497"},{"type":"REPORT","url":"https://github.com/jhy/jsoup/issues/2538"},{"type":"FIX","url":"https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jhy/jsoup","events":[{"introduced":"00061629b5b91f09afbfea7eae3710bb3253c5b9"},{"fixed":"92f1aca552548b484bc7d4b94c51e48b8e6eca70"},{"fixed":"bb077a8b0da1203cf11d5139967f0d52fe8f5a59"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"1.14.3"},{"fixed":"1.23.1"}]}}],"versions":["jsoup-1.22.2","jsoup-1.22.1","jsoup-1.21.2","jsoup-1.21.1","jsoup-1.20.1","jsoup-1.19.1","jsoup-1.18.3","jsoup-1.18.2","jsoup-1.18.1","jsoup-1.17.2","jsoup-1.17.1","jsoup-1.16.2","jsoup-1.16.1","jsoup-1.15.4","jsoup-1.15.3","jsoup-1.15.2","jsoup-1.15.1","jsoup-1.14.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71497.json","vanir_signatures_modified":"2026-08-09T08:05:13Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70","target":{"file":"src/test/java/org/jsoup/parser/HtmlParserTest.java"},"deprecated":false,"digest":{"line_hashes":["181937326342852076969631988948472760966","153759009126021349332686888965552578759","110103009878483414043234074826686750999","280983565190875460999991314424467850322","44879387428943934398063494593555988781","281013167577187782941348744601305113415","132651764799526623173506411791279872674","118801729594699250346882549224222220386"],"threshold":0.9},"id":"CVE-2026-71497-02baaf11","signature_type":"Line"},{"target":{"file":"src/main/java/org/jsoup/parser/Token.java","function":"nameAttr"},"deprecated":false,"digest":{"function_hash":"157600237706555189700778834611797555669","length":171},"id":"CVE-2026-71497-17c24fb8","signature_type":"Function","signature_version":"v1","source":"https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70"},{"signature_version":"v1","source":"https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70","target":{"file":"src/main/java/org/jsoup/parser/TagSet.java","function":"valueOf"},"deprecated":false,"digest":{"function_hash":"42768351644726929465130838818785995138","length":670},"id":"CVE-2026-71497-330e2957","signature_type":"Function"},{"id":"CVE-2026-71497-406aaee9","signature_type":"Function","signature_version":"v1","source":"https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70","target":{"file":"src/main/java/org/jsoup/parser/Token.java","function":"appendTagName"},"deprecated":false,"digest":{"function_hash":"99205503112061543274572075647532678468","length":229}},{"source":"https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70","target":{"file":"src/main/java/org/jsoup/parser/Token.java","function":"name"},"deprecated":false,"digest":{"function_hash":"320346690699526294315085580175792088986","length":141},"id":"CVE-2026-71497-4acb22d2","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["114506412939303152943025189246662976791","6468248189561806296306208327357264893","212483296159735211704915955923332469908","166031996771800364001160511635887560197","307895170492363027608201065183334499350","170722787310263641587941796978902641014","65825153413339884381956325733625700351","117250129441957657566612654968240729890","76610147440603746967711415791025298649","70306176552762831276031226579322779318","330843490298097763512895131146049888033","9994816610627898568336697686211625063","12882196562779033412965184643645673214","339063576627228652424626037814535341877","269717461413623348418939782708611252891"],"threshold":0.9},"id":"CVE-2026-71497-568c4699","signature_type":"Line","signature_version":"v1","source":"https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70","target":{"file":"src/main/java/org/jsoup/parser/Token.java"},"deprecated":false},{"digest":{"line_hashes":["247966881702737650215080544208975685021","286871881968807575649285402629406307476","285228090814398608008872802180812570997","173609387921123636447835373953798411602"],"threshold":0.9},"id":"CVE-2026-71497-b6487cec","signature_type":"Line","signature_version":"v1","source":"https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70","target":{"file":"src/main/java/org/jsoup/parser/TagSet.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"113575858987951919013459713086601574071","length":233},"id":"CVE-2026-71497-f754b815","signature_type":"Function","signature_version":"v1","source":"https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70","target":{"function":"trimNormalizeElementNamesInBuilder","file":"src/test/java/org/jsoup/parser/HtmlParserTest.java"}}]}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}