CVE-2026-71497: jsoup: Cleaner may expose markup with custom raw-text elements

August 6, 2026

When a custom Safelist permits certain raw-text elements, jsoup may incorrectly sanitize malformed HTML containing a tag name that ends in a control character. The tag may acquire the parsing behavior of a different element, causing content that should remain text to be emitted as active markup after serialization and potentially allowing XSS.

jsoup’s built-in Safelists are unaffected.

References

github.com/advisories/GHSA-pmhh-3w7g-xqp8
github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70
github.com/jhy/jsoup/issues/2538
github.com/jhy/jsoup/releases/tag/jsoup-1.23.1
github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8
nvd.nist.gov/vuln/detail/CVE-2026-71497

Code Behaviors & Features

Detect and mitigate CVE-2026-71497 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →