CVE-2026-71497

Name of the Vulnerable Software and Affected Versions jsoup versions 1.14.3 through 1.23.0

Description The HTML parser incorrectly handles malformed tag names that end in a control character, which can cause the tag to adopt the parsing behavior of a different element. When a custom Safelist permits specific raw-text elements, this misparsing may allow content intended to be inert text to be emitted as active markup during serialization, potentially leading to cross-site scripting (XSS). Built-in Safelists are not affected.

Recommendations Update to version 1.23.1. As a temporary workaround, do not permit raw-text elements in custom Safelist configurations used to clean untrusted HTML.