4 jsoup vulnerabilities

Cleaner HTML-sanitizer bypass: mutation-XSS via MathML namespace confusion Reported as: Inside MathML foreign content, <style> is a raw-text element. jsoup therefore stores <img src=x onerror=...> as opaque text (a DataNode) and copies it verbatim, so it never sees an img element or an onerror attribute to strip. When a browser re-parses jsoup's serialized output under HTML5 MathML text-integration-point rules, that text turns back into a live <img onerror> and fires. The bug is a differential between parsing, serializing, and re-parsing (mXSS). jsoup already rejects noscript in safelists for this same class of problem (see Safelist.addTags), but it has no equivalent guard for math or svg combined with a raw-text element. Safelist sl = Safelist.none().addTags("math", "mtext", "table", "mglyph", "style"); String out = Jsoup.clean("<math><mtext><table><mglyph><style><img src=x onerror=alert(1)></style>", sl); out still contains <img src=x onerror=alert(1)> inside <style>. Render it in…