The vulnerability lies in jsoup’s HTML parser, which can misinterpret a malformed tag name that ends with a control character. When a custom Safelist permits raw‑text elements, this misparsing causes content that should remain inert text to be treated as active markup during serialization, creating an XSS vector. The flaw is classified as CWE‑79 and CWE‑1289 and can lead to the execution of attacker‑provided scripts in a user’s browser if the parsed content is rendered.

The defect affects the Java library jsoup, vendor jhy, for all releases from 1.14.3 up to, but not including, 1.23.1. Users of versions 1.14.3 through 1.23.0 who configure a custom Safelist that allows raw‑text elements are vulnerable. The built‑in Safelists provided by jsoup are not impacted.

The vulnerability receives a CVSS score of 4.7, indicating moderate severity. No EPSS score is available, and the attack remains undetected in the CISA KEV catalog. Exploitation requires an application to feed attacker‑controlled HTML to jsoup’s Cleaner with a custom Safelist that permits raw‑text elements. If the application uses only the default Safelists, the risk is reduced. The threat is therefore constrained to environments where custom Safelists are in use and the parser is invoked on untrusted content.