Sulkta-OSS/element-x-ada
Archived
3
0
Fork 0
Code Issues 1 Pull requests 10 Projects Releases Packages Wiki Activity Actions

Update dependency org.jsoup:jsoup to v1.23.1 [SECURITY] #28

Open
renovate wants to merge 1 commit from renovate/maven-org.jsoup-jsoup-vulnerability into main
pull from: renovate/maven-org.jsoup-jsoup-vulnerability
merge into: Sulkta-OSS:main
Conversation 0 Commits 1 Files changed 1 +1 -1
renovate commented 2026-08-06 23:39:06 -07:00
Member
Copy link

This PR contains the following updates:

Package Change Age Confidence
org.jsoup:jsoup (source) 1.22.2 → 1.23.1 age confidence

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

jsoup: Cleaner may expose markup with custom raw-text elements

CVE-2026-71497 / GHSA-pmhh-3w7g-xqp8

More information

Details

When a custom Safelist permits certain raw-text elements, jsoup may incorrectly sanitize malformed HTML containing a tag name that ends in a control character. The tag may acquire the parsing behavior of a different element, causing content that should remain text to be emitted as active markup after serialization and potentially allowing XSS.

jsoup’s built-in Safelists are unaffected.

Patches

Upgrade to jsoup 1.23.1.

Workarounds

Until upgrading, do not permit raw-text elements in custom Safelists used to clean untrusted HTML.

Additional security considerations

This fix addresses malformed tag-name handling only.

Permitting raw-text elements in a custom Safelist does not make their contents inherently safe. For example, applications that permit style must apply appropriate CSS safeguards separately, because jsoup does not parse or sanitize CSS.

Severity

  • CVSS Score: 4.7 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [org.jsoup:jsoup](https://jsoup.org/) ([source](https://github.com/jhy/jsoup)) | `1.22.2` → `1.23.1` | ![age](https://developer.mend.io/api/mc/badges/age/maven/org.jsoup:jsoup/1.23.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/maven/org.jsoup:jsoup/1.22.2/1.23.1?slim=true) | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/3) for more information. --- ### jsoup: Cleaner may expose markup with custom raw-text elements [CVE-2026-71497](https://nvd.nist.gov/vuln/detail/CVE-2026-71497) / [GHSA-pmhh-3w7g-xqp8](https://github.com/advisories/GHSA-pmhh-3w7g-xqp8) <details> <summary>More information</summary> #### Details When a custom `Safelist` permits certain raw-text elements, jsoup may incorrectly sanitize malformed HTML containing a tag name that ends in a control character. The tag may acquire the parsing behavior of a different element, causing content that should remain text to be emitted as active markup after serialization and potentially allowing XSS. jsoup’s built-in Safelists are unaffected. ##### Patches Upgrade to jsoup 1.23.1. ##### Workarounds Until upgrading, do not permit raw-text elements in custom Safelists used to clean untrusted HTML. ##### Additional security considerations This fix addresses malformed tag-name handling only. Permitting raw-text elements in a custom `Safelist` does not make their contents inherently safe. For example, applications that permit `style` must apply appropriate CSS safeguards separately, because jsoup does not parse or sanitize CSS. #### Severity - CVSS Score: 4.7 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N` #### References - [https://github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8](https://github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8) - [https://github.com/jhy/jsoup/issues/2538](https://github.com/jhy/jsoup/issues/2538) - [https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70](https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70) - [https://github.com/jhy/jsoup](https://github.com/jhy/jsoup) - [https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.1](https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.1) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-pmhh-3w7g-xqp8) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNTMuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI1My4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJQUi1EZXBlbmRlbmNpZXMiXX0=-->
renovate added 1 commit 2026-08-06 23:39:07 -07:00
Update dependency org.jsoup:jsoup to v1.23.1 [SECURITY]
Some checks failed
APK Build / Build APKs (pull_request) Failing after 1s
Details
APK Build / Build APKs-1 (pull_request) Failing after 1s
Details
APK Build / Build APKs-2 (pull_request) Failing after 1s
Details
Enterprise APK Build / Build Enterprise APKs (pull_request) Has been skipped
Details
Enterprise APK Build / Build Enterprise APKs-1 (pull_request) Has been skipped
Details
Enterprise APK Build / Build Enterprise APKs-2 (pull_request) Has been skipped
Details
Danger CI / Danger main check (pull_request) Has been skipped
Details
Maestro (local) / Build APK (pull_request) Failing after 1s
Details
Maestro (local) / Maestro test suite (pull_request) Has been skipped
Details
Code Quality Checks / Search for forbidden patterns (pull_request) Failing after 1s
Details
Code Quality Checks / Search for invalid screenshot files (pull_request) Failing after 1s
Details
Code Quality Checks / Search for invalid dependencies (pull_request) Failing after 1s
Details
Code Quality Checks / Konsist tests (pull_request) Failing after 1s
Details
Code Quality Checks / Compose tests (pull_request) Failing after 1s
Details
Code Quality Checks / Android lint check (pull_request) Failing after 1s
Details
Code Quality Checks / Detekt checks (pull_request) Failing after 1s
Details
Code Quality Checks / Ktlint checks (pull_request) Failing after 1s
Details
Code Quality Checks / Doc checks (pull_request) Failing after 1s
Details
Code Quality Checks / Check shell scripts (pull_request) Failing after 1s
Details
Code Quality Checks / Run zizmor (pull_request) Failing after 1s
Details
Sonar / Sonar Quality Checks (pull_request) Failing after 1s
Details
Test / Runs unit tests (pull_request) Failing after 1s
Details
Validate Git LFS / Validate (pull_request) Failing after 1s
Details
Community PR notice / Welcome comment (pull_request_target) Has been skipped
Details
Code Quality Checks / Project Check Suite (pull_request) Has been skipped
Details
ff2acc2e3c
This repository is archived. You cannot comment on pull requests.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Sulkta-OSS/element-x-ada#28
No description provided.
Delete branch "renovate/maven-org.jsoup-jsoup-vulnerability"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?