DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-71497: CVE-2026-71497: Parser-Browser Desynchronization leading to XSS in jsoup Sanitizer

#security #cve #cybersecurity

CVE-2026-71497: Parser-Browser Desynchronization leading to XSS in jsoup Sanitizer

Vulnerability ID: CVE-2026-71497
CVSS Score: 4.7
Published: 2026-08-06

jsoup is a widely used Java library for working with real-world HTML. Versions 1.14.3 up to but excluding 1.23.1 contain a Cross-Site Scripting (XSS) vulnerability. When an application configures a custom Safelist that explicitly permits certain raw-text or RCDATA elements, such as style, title, or iframe, an attacker can exploit a parser-browser desynchronization flaw to bypass sanitization. This is achieved by utilizing trailing ASCII control characters that are handled differently by the HTML5 parsing specification and Java's string normalization methods, resulting in unescaped markup execution on the client side.

TL;DR

A parser differential between HTML5 specifications and Java's string-trimming rules in jsoup versions 1.14.3 to 1.23.0 allows unauthenticated attackers to bypass HTML sanitizers and execute arbitrary scripts in a victim's browser context.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-79 (Cross-site Scripting)
  • Attack Vector: Network (AV:N)
  • CVSS Base Score: 4.7 (Medium)
  • EPSS Score: 0.00043
  • Exploit Status: Proof-of-Concept (PoC)
  • CISA KEV Status: Not Listed

Affected Systems

  • Java Web Applications utilizing the jsoup HTML parser library versions >= 1.14.3 and < 1.23.1 with custom Safelist configurations.
  • jsoup: >= 1.14.3, < 1.23.1 (Fixed in: 1.23.1)

Code Analysis

Commit: 92f1aca

Fix tag normalization and control character handling in Tokenizer and Parser.

diff --git a/src/main/java/org/jsoup/parser/TagSet.java b/src/main/java/org/jsoup/parser/TagSet.java
index 137..7ef81
--- a/src/main/java/org/jsoup/parser/TagSet.java
+++ b/src/main/java/org/jsoup/parser/TagSet.java
Enter fullscreen mode Exit fullscreen mode

Exploit Details

Mitigation Strategies

  • Upgrade the jsoup dependency to version 1.23.1 or higher to fix the parser desynchronization.
  • Audit and restrict the use of raw-text container elements (style, title, iframe) in custom Safelist configurations.
  • Implement a robust Content Security Policy (CSP) to block the execution of inline scripts in case of a sanitizer bypass.

Remediation Steps:

  1. Locate the project build configuration file (pom.xml for Maven, build.gradle for Gradle).
  2. Update the jsoup dependency version string to '1.23.1' or later.
  3. Review all instances of 'Safelist' within the codebase to identify custom configurations allowing raw-text elements.
  4. Deploy the upgraded application and monitor server logs for input patterns containing control characters.

References

Read the full report for CVE-2026-71497 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)