CVE-2026-71497

A flaw was found in jsoup, a Java library for working with HTML. The HTML parser incorrectly handles malformed tag names ending in a control character. When a custom Safelist allows certain raw-text elements, this misparsing can cause content that should be inert to be processed as active markup after serialization. This could allow a remote attacker to achieve cross-site scripting (XSS).

This cross-site scripting flaw in jsoup requires a custom Safelist that explicitly allows raw-text elements, which is not a default configuration. Exploitation is limited to applications processing untrusted HTML with such a permissive custom Safelist, reducing the overall risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.