CVE-2026-71497¶
WSO2 Products impacted: no
Customer actions required: no
REPORTED VULNERABILITY¶
When a custom Safelist permits certain raw-text elements, jsoup may incorrectly sanitize malformed HTML containing a tag name that ends in a control character. The tag may acquire the parsing behavior of a different element, causing content that should remain text to be emitted as active markup after serialization, and potentially allowing cross-site scripting (XSS). jsoup's built-in Safelists are unaffected 1.
Affected versions: >= 1.14.3, < 1.23.1. Fixed in jsoup 1.23.1.
REPORTED PRODUCTS¶
- WSO2 Micro Integrator : 4.5.0, 4.6.0
- WSO2 Integration Control Plane: 1.2.0
- WSO2 API Manager : 3.2.1, 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.7.0
- WSO2 API Control Plane : 4.5.0, 4.6.0, 4.7.0
- WSO2 Universal Gateway : 4.5.0, 4.6.0, 4.7.0
- WSO2 Traffic Manager : 4.5.0, 4.6.0, 4.7.0
- WSO2 Identity Server : 7.2.0, 7.3.0
WSO2 JUSTIFICATION¶
jsoup is not shipped as a standalone dependency in the reported WSO2 products. These products bundle jinjava version 2.7.6, which repackages jsoup version 1.15.3 as an internal dependency — a version within the affected range.
A source-code review of jinjava 2.7.6 confirmed that jsoup's Safelist is referenced in exactly one location, StripTagsFilter 2, where the code calls Jsoup.clean(cleanedVal, Safelist.none()). Safelist.none() is jsoup's own built-in Safelist.
Since a custom Safelist permitting a raw-text element does not exist in any of the reported WSO2 products, this vulnerability is not exploitable in these products.
Because jsoup is an internal dependency of jinjava, it cannot be upgraded independently. As of the date of this justification, no released jinjava version 3 bundles an unaffected jsoup version, so there is no upstream release to upgrade to. jinjava will be upgraded once an upstream release that includes an unaffected jsoup version becomes available.