AIKIDO-2026-499637
jsoup is vulnerable to Cross-Site Scripting (XSS)
47
Medium Risk
This Affects:
jsoupTL;DR
jsoup's Cleaner sanitizes HTML against a Safelist to strip unsafe content, but the built-in Safelists are not affected by this issue. When a custom Safelist permits raw-text elements, malformed HTML whose tag name ends in a control character can be normalized so the tag adopts the parsing behavior of a different element. Content that should remain text is then emitted as active markup after serialization, enabling cross-site scripting. The fix preserves control characters in parsed tag names so the token and its resulting tag stay consistent.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use a custom Safelist that permits raw-text elements to clean untrusted HTML.
Background info
jsoup is vulnerable to Cross-Site Scripting (XSS) in versions 1.14.3 - 1.22.2.
How to fix this
Upgrade the org.jsoup:jsoup library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.