Description

jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-06T22:18:32.043Z",
  "pubdate": "2026-08-06T22:18:32.043Z",
  "executiveSummary": "An input parsing vulnerability exists in the jsoup Java library, specifically affecting the HTML parser when processing malformed tag names ending in control characters. This defect can lead to improper handling of raw-text elements, resulting in potential Cross-Site Scripting (XSS) under specific configurations.\nThe vulnerability occurs exclusively when applications utilize a custom Safelist configuration that explicitly permits certain raw-text elements. The built-in jsoup Safelists are inherently safe and not affected by this parsing anomaly.\nWhen exploited, an attacker capable of supplying crafted HTML input can manipulate the parser state. This causes content that is intended to remain as inert text to be serialized and emitted as active executable markup, bypassing intended sanitization controls.\nThe risk implication involves arbitrary script execution within the context of a victim's browser session if vulnerable parsed output is rendered in a web application. Remediation requires updating the affected library to the patched version.",
  "technicalDetails": "The root cause of the vulnerability resides in the jsoup HTML parser's state machine logic regarding tag name tokenization. Specifically, the parser incorrectly handles malformed tag names that terminate with a control character. This parsing flaw causes the target tag to deviate from its expected tokenization path and acquire the structural parsing behavior characteristic of a completely different HTML element.\nThe vulnerable component is the HTML parser module within the jsoup library, affecting versions 1.14.3 up to, but not including, version 1.23.1.\nExploitation requires an attacker to inject specially crafted HTML payload containing a malformed tag name ending with a control character. This input must be processed by the jsoup parser while utilizing a custom Safelist that permits raw-text elements. Because of the parser misbehavior, the boundary between raw text content and active markup is incorrectly evaluated.\nDuring serialization, the parser emits the manipulated content as active markup instead of treating it as inert text. When this serialized output is subsequently rendered by a web browser, any embedded JavaScript or executable markup executes within the security context of the user, leading to a Cross-Site Scripting condition.\nNo specific authentication, privilege level, or network exposure prerequisites are inherent to the parser itself, as exploitability depends entirely on how the host application accepts untrusted HTML input and applies custom sanitization Safelists."
}