PT-2022-4449
CVE-2022-36033
·
Published
2022-08-24
·
Updated
2026-08-14
Description by
CVSS 2.0
9.4
HighMetricsAV:N/AC:L/Au:N/C:C/I:C/A:N
Name of the Vulnerable Software and Affected Versions
jsoup versions prior to 1.15.3
Description
The issue is related to the incorrect sanitization of HTML including
javascript: URL expressions, which could allow cross-site scripting (XSS) attacks when a reader subsequently clicks that link. If the non-default SafeList.preserveRelativeLinks option is enabled, HTML including javascript: URLs that have been crafted with control characters will not be sanitized. If the site that this HTML is published on does not set a Content Security Policy, an XSS attack is then possible.Recommendations
To resolve the issue for versions prior to 1.15.3:
- Upgrade to version 1.15.3.
- Additionally, as the unsanitized input may have been persisted, old content should be cleaned again using the updated version.
As a temporary workaround, consider disabling the
SafeList.preserveRelativeLinksoption, which will rewrite input URLs as absolute URLs. Ensure an appropriate Content Security Policy is defined, which should be used regardless of upgrading, as a defence-in-depth best practice.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾