{"cve":"CVE-2022-36033","nvd":{"published":"2022-08-29T17:15:08.523","modified":"2026-06-17T04:52:46.950","status":"Modified","description":"jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety. jsoup may incorrectly sanitize HTML including `javascript:` URL expressions, which could allow XSS attacks when a reader subsequently clicks that link. If the non-default `SafeList.preserveRelativeLinks` option is enabled, HTML including `javascript:` URLs that have been crafted with control characters will not be sanitized. If the site that this HTML is published on does not set a Content Security Policy, an XSS attack is then possible. This issue is patched in jsoup 1.15.3. Users should upgrade to this version. Additionally, as the unsanitized input may have been persisted, old content should be cleaned again using the updated version. To remediate this issue without immediately upgrading: - disable `SafeList.preserveRelativeLinks`, which will rewrite input URLs as absolute URLs - ensure an appropriate [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) is defined. (This should be used regardless of upgrading, as a defence-in-depth best practice.)","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},"cwes":["CWE-79","CWE-87"],"references":["https://github.com/jhy/jsoup/releases/tag/jsoup-1.15.3","https://github.com/jhy/jsoup/security/advisories/GHSA-gp7f-rwcx-9369","https://jsoup.org/news/release-1.15.3","https://security.netapp.com/advisory/ntap-20221104-0006/","https://github.com/jhy/jsoup/releases/tag/jsoup-1.15.3"],"products":["jsoup:jsoup","netapp:management_services_for_element_software","netapp:management_services_for_netapp_hci","netapp:oncommand_workflow_automation"],"source":"nvd","synced_at":"2026-10-19T21:35:14.992143698+00:00"},"epss":{"cve":"CVE-2022-36033","score":0.01643,"percentile":0.76427,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-gp7f-rwcx-9369","url":"https://osv.dev/vulnerability/GHSA-gp7f-rwcx-9369","summary":"jsoup may not sanitize code injection XSS attempts if SafeList.preserveRelativeLinks is enabled","modified":"2026-09-10T03:49:45.687546905Z","packages":[{"ecosystem":"Maven","name":"org.jsoup:jsoup","purl":"pkg:maven/org.jsoup/jsoup","ranges":["<1.15.3"],"fixed":["1.15.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}