jsoup (Java HTML Parser), Cross-Site Scripting (XSS) via Parsing Inconsistency, CVE-2026-71497 (Moderate) -DC-Aug2026-1476

Listen to this Post

🐢▶️ Listen🚀

How CVE-2026-71497 Works

jsoup is a Java library used extensively for parsing, cleaning, and manipulating real-world HTML. The library provides a `Cleaner` class that sanitizes untrusted HTML against a whitelist of allowed elements and attributes, known as a Safelist. CVE-2026-71497 arises from a parsing inconsistency within jsoup’s HTML parser when it encounters a malformed HTML tag name that ends with a control character (e.g., tab, newline, or other non-printable ASCII values).
The vulnerability is triggered under a specific set of conditions. For the issue to be exploitable, an application must be using a custom `Safelist` that explicitly permits certain “raw-text” elements. Raw-text elements in HTML are those whose content is meant to be interpreted as raw text rather than parsed as markup, examples include <script>, <style>, and <>. jsoup’s built-in `Safelist` configurations are not affected.
When the parser processes HTML with a tag name like `` (where `%01` is a control character), it fails to correctly terminate the tag name. Instead of recognizing it as an invalid tag and treating its content as text, the parser may misinterpret it as a valid raw-text element, such as a `