AIKIDO-2026-499637

TL;DR

jsoup's Cleaner sanitizes HTML against a Safelist to strip unsafe content, but the built-in Safelists are not affected by this issue. When a custom Safelist permits raw-text elements, malformed HTML whose tag name ends in a control character can be normalized so the tag adopts the parsing behavior of a different element. Content that should remain text is then emitted as active markup after serialization, enabling cross-site scripting. The fix preserves control characters in parsed tag names so the token and its resulting tag stay consistent.