CVE-2022-36033: XSS Vulnerability in org.jsoup:jsoup
Summary
CVE-2022-36033: jsoup may not sanitize code injection XSS attempts if SafeList.preserveRelativeLinks is enabled. Affects org.jsoup:jsoup versions < 1.15.3. Fixed in 1.15.3. How to fix ↓
Also tracked for
- jsoup · Debian:11
The same CVE-2022-36033 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.jsoup:jsoup is an open-source Java library used for parsing HTML and manipulating HTML documents. It provides a convenient API for extracting and manipulating data from HTML documents. However, a vulnerability has been discovered in jsoup that could allow for cross-site scripting (XSS) attacks if certain conditions are met.
Vulnerability Detail
The vulnerability in jsoup arises from its handling of HTML containing javascript: URL expressions. By embedding control characters into the href attribute value, an attacker can bypass the URL validation check and inject malicious code. If the SafeList.preserveRelativeLinks option is enabled and a Content Security Policy is not set, the unsanitized HTML can lead to XSS attacks. This can be particularly dangerous for sites that accept user input HTML and use jsoup to sanitize it.
How To Fix
Latest published version: 1.23.2 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.15.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
To temporarily mitigate the vulnerability without upgrading, follow these steps:
- Disable the
SafeList.preserveRelativeLinksoption in jsoup. - Implement a Content Security Policy that disallows javascript expressions in link URLs.
Conclusion
The XSS vulnerability in org.jsoup:jsoup can be mitigated by upgrading to version 1.15.3 or later, cleaning previously persisted content, and implementing a Content Security Policy. Disabling the SafeList.preserveRelativeLinks option can provide temporary mitigation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jsoup:jsoup →
FAQ
The vulnerability allows for potential cross-site scripting (XSS) attacks on sites that accept user input HTML and use jsoup to sanitize it. If the SafeList.preserveRelativeLinks option is enabled and a Content Security Policy is not set, an attacker can inject malicious code that may be executed when a reader clicks on a crafted link.
To fix this vulnerability, upgrade to jsoup version 1.15.3 or later. Additionally, ensure that any previously persisted content is cleaned using the updated version. If immediate upgrading is not possible, disable the SafeList.preserveRelativeLinks option and implement a Content Security Policy that disallows javascript expressions in link URLs.
Yes, you can temporarily mitigate the vulnerability by disabling the SafeList.preserveRelativeLinks option in jsoup and implementing a Content Security Policy that disallows javascript expressions in link URLs.
A Content Security Policy (CSP) defines the allowed sources of various types of content in a web page. By disallowing javascript expressions in link URLs, a CSP can prevent the execution of injected malicious code, effectively mitigating the XSS vulnerability.
There is no known public exploit for this vulnerability at the time of this advisory. However, it is important to promptly apply the recommended fixes to prevent potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for org.jsoup:jsoup.
