[NEW] [medium] jsoup: Vulnerability enables Cross-Site Scripting

mediumCVE-2026-71497

A remote, anonymous attacker can exploit a vulnerability in jsoup to perform a Cross-Site Scripting attack.

CSIRTS triage

vendor: jsoup product: jsoup Cross-site scripting

What: A Cross-Site Scripting vulnerability allows remote anonymous attackers to inject malicious scripts.
Who is affected: All jsoup deployments handling untrusted HTML input are affected.
Urgency: Medium severity; no evidence of active exploitation, but XSS is easily exploitable.
Action: Update to the patched version of jsoup when available.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch jsoup

Get an email when a new jsoup advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: medium
Published: 2026-08-07
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2698

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-71497	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for jsoup

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-71497: jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HT…nvd · 2026-08-06
mediumGHSA-pmhh-3w7g-xqp8: jsoup: Cleaner may expose markup with custom raw-text elementsghsa · 2026-08-06