https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Mon, 10 Aug 2026 13:06:51 +0000 https://vulnerability.circl.lu/sighting/85215c2a-8cfd-405e-8896-b195fed81eb7/export {"uuid": "85215c2a-8cfd-405e-8896-b195fed81eb7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71497", "type": "seen", "source": "https://gist.github.com/alon710/b4340b7774927252fafb9cfdb5e51a49", "content": "# CVE-2026-71497: CVE-2026-71497: Parser-Browser Desynchronization leading to XSS in jsoup Sanitizer\n\n> **CVSS Score:** 4.7\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71497\n\n## Summary\njsoup is a widely used Java library for working with real-world HTML. Versions 1.14.3 up to but excluding 1.23.1 contain a Cross-Site Scripting (XSS) vulnerability. When an application configures a custom Safelist that explicitly permits certain raw-text or RCDATA elements, such as style, title, or iframe, an attacker can exploit a parser-browser desynchronization flaw to bypass sanitization. This is achieved by utilizing trailing ASCII control characters that are handled differently by the HTML5 parsing specification and Java's string normalization methods, resulting in unescaped markup execution on the client side.\n\n## TL;DR\nA parser differential between HTML5 specifications and Java's string-trimming rules in jsoup versions 1.14.3 to 1.23.0 allows unauthenticated attackers to bypass HTML sanitizers and execute arbitrary scripts in a victim's browser context.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79 (Cross-site Scripting)\n- **Attack Vector**: Network (AV:N)\n- **CVSS Base Score**: 4.7 (Medium)\n- **EPSS Score**: 0.00043\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Java Web Applications utilizing the jsoup HTML parser library versions >= 1.14.3 and < 1.23.1 with custom Safelist configurations.\n- **jsoup**: >= 1.14.3, < 1.23.1 (Fixed in: `1.23.1`)\n\n## Mitigation\n\n- Upgrade the jsoup dependency to version 1.23.1 or higher to fix the parser desynchronization.\n- Audit and restrict the use of raw-text container elements (style, title, iframe) in custom Safelist configurations.\n- Implement a robust Content Security Policy (CSP) to block the execution of inline scripts in case of a sanitizer bypass.\n\n**Remediation Steps:**\n1. Locate the project build configuration file (pom.xml for Maven, build.gradle for Gradle).\n2. Update the jsoup dependency version string to '1.23.1' or later.\n3. Review all instances of 'Safelist' within the codebase to identify custom configurations allowing raw-text elements.\n4. Deploy the upgraded application and monitor server logs for input patterns containing control characters.\n\n## References\n\n- [jsoup Security Advisory GHSA-pmhh-3w7g-xqp8](https://github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8)\n- [jsoup Issue Tracker #2538](https://github.com/jhy/jsoup/issues/2538)\n- [jsoup Release Version 1.23.1](https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71497) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T08:33:25.745229Z"} {"uuid": "85215c2a-8cfd-405e-8896-b195fed81eb7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71497", "type": "seen", "source": "https://gist.github.com/alon710/b4340b7774927252fafb9cfdb5e51a49", "content": "# CVE-2026-71497: CVE-2026-71497: Parser-Browser Desynchronization leading to XSS in jsoup Sanitizer\n\n> **CVSS Score:** 4.7\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71497\n\n## Summary\njsoup is a widely used Java library for working with real-world HTML. Versions 1.14.3 up to but excluding 1.23.1 contain a Cross-Site Scripting (XSS) vulnerability. When an application configures a custom Safelist that explicitly permits certain raw-text or RCDATA elements, such as style, title, or iframe, an attacker can exploit a parser-browser desynchronization flaw to bypass sanitization. This is achieved by utilizing trailing ASCII control characters that are handled differently by the HTML5 parsing specification and Java's string normalization methods, resulting in unescaped markup execution on the client side.\n\n## TL;DR\nA parser differential between HTML5 specifications and Java's string-trimming rules in jsoup versions 1.14.3 to 1.23.0 allows unauthenticated attackers to bypass HTML sanitizers and execute arbitrary scripts in a victim's browser context.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79 (Cross-site Scripting)\n- **Attack Vector**: Network (AV:N)\n- **CVSS Base Score**: 4.7 (Medium)\n- **EPSS Score**: 0.00043\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Java Web Applications utilizing the jsoup HTML parser library versions >= 1.14.3 and < 1.23.1 with custom Safelist configurations.\n- **jsoup**: >= 1.14.3, < 1.23.1 (Fixed in: `1.23.1`)\n\n## Mitigation\n\n- Upgrade the jsoup dependency to version 1.23.1 or higher to fix the parser desynchronization.\n- Audit and restrict the use of raw-text container elements (style, title, iframe) in custom Safelist configurations.\n- Implement a robust Content Security Policy (CSP) to block the execution of inline scripts in case of a sanitizer bypass.\n\n**Remediation Steps:**\n1. Locate the project build configuration file (pom.xml for Maven, build.gradle for Gradle).\n2. Update the jsoup dependency version string to '1.23.1' or later.\n3. Review all instances of 'Safelist' within the codebase to identify custom configurations allowing raw-text elements.\n4. Deploy the upgraded application and monitor server logs for input patterns containing control characters.\n\n## References\n\n- [jsoup Security Advisory GHSA-pmhh-3w7g-xqp8](https://github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8)\n- [jsoup Issue Tracker #2538](https://github.com/jhy/jsoup/issues/2538)\n- [jsoup Release Version 1.23.1](https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71497) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T08:33:25.745229Z"} https://vulnerability.circl.lu/sighting/85215c2a-8cfd-405e-8896-b195fed81eb7/export Fri, 07 Aug 2026 08:33:25 +0000