Vulnerability GHSA-pmhh-3w7g-xqp8

Medium Risk

2 months ago

jsoup: Cleaner may expose markup with custom raw-text elements

1.14.3 and 1.16.1 - 1.16.2 and 1.17.1 - 1.17.2 and 1.19.1 and 1.20.1 and 1.21.1 - 1.21.2 and 1.22.1 - 1.22.2

Summary

jsoup: Cleaner may expose markup with custom raw-text elements

Details

When a custom Safelist permits certain raw-text elements, jsoup may incorrectly sanitize malformed HTML containing a tag name that ends in a control character. The tag may acquire the parsing behavior of a different element, causing content that should remain text to be emitted as active markup after serialization and potentially allowing XSS.

jsoup’s built-in Safelists are unaffected.

Patches

Upgrade to jsoup 1.23.1.

Workarounds

Until upgrading, do not permit raw-text elements in custom Safelists used to clean untrusted HTML.

Additional security considerations

This fix addresses malformed tag-name handling only.

Permitting raw-text elements in a custom Safelist does not make their contents inherently safe. For example, applications that permit style must apply appropriate CSS safeguards separately, because jsoup does not parse or sanitize CSS.