{"id":"RHLW-2026-cf15e492f63e9e38","summary":"Lightwell Security Advisory: jsoup 1.15.1.rhlw-00001","details":"Red Hat Lightwell has released org.jsoup:jsoup 1.15.1.rhlw-00001 with a backported security fix.\n\nCVE-2022-36033: jsoup may not sanitize Cross-Site Scripting (XSS) attempts if SafeList.preserveRelativeLinks is enabled\n\nThis patched artifact is a drop-in replacement for org.jsoup:jsoup 1.15.1 from Maven Central.","modified":"2026-10-22T00:08:26.961200405Z","published":"2026-07-29T13:00:26Z","upstream":["CVE-2022-36033","GHSA-gp7f-rwcx-9369"],"references":[{"type":"WEB","url":"https://github.com/jhy/jsoup/releases/tag/jsoup-1.15.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36033.json"},{"type":"ADVISORY","url":"https://github.com/jhy/jsoup/security/advisories/GHSA-gp7f-rwcx-9369"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36033"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-gp7f-rwcx-9369"}],"affected":[{"package":{"name":"org.jsoup:jsoup","ecosystem":"Red Hat Lightwell:Maven","purl":"pkg:maven/org.jsoup/jsoup"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.1.rhlw-00001"}]}],"versions":["0.2.1b","0.2.2","0.3.1","1.1.1","1.10.1","1.10.2","1.10.3","1.11.1","1.11.2","1.11.3","1.12.1","1.12.2","1.13.1","1.14.1","1.14.2","1.14.3","1.15.1","1.2.1","1.2.2","1.2.3","1.3.1","1.3.2","1.3.3","1.4.1","1.5.1","1.5.2","1.6.0","1.6.1","1.6.2","1.6.3","1.7.1","1.7.2","1.7.3","1.8.1","1.8.2","1.8.3","1.9.1","1.9.2"],"database_specific":{"source":"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-cf15e492f63e9e38.json","lightwell":{"backport_base_version":"1.15.1","remediated_version":"1.15.1.rhlw-00001","repository_url":"https://packages.redhat.com/lightwell/java/remediated/"}}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"credits":[{"name":"Red Hat Lightwell","type":"REMEDIATION_DEVELOPER"}]}