CVE-2026-71497: jsoup: Cleaner may expose markup with custom raw-text elements

August 6, 2026

When a custom Safelist permits certain raw-text elements, jsoup may incorrectly sanitize malformed HTML containing a tag name that ends in a control character. The tag may acquire the parsing behavior of a different element, causing content that should remain text to be emitted as active markup after serialization and potentially allowing XSS.

jsoup’s built-in Safelists are unaffected.

References

github.com/advisories/GHSA-pmhh-3w7g-xqp8
github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70
github.com/jhy/jsoup/issues/2538
github.com/jhy/jsoup/releases/tag/jsoup-1.23.1
github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8
nvd.nist.gov/vuln/detail/CVE-2026-71497

Code Behaviors & Features

Detect and mitigate CVE-2026-71497 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →