Repository navigation
Upgrade jsoup #1342
Description
@jasmith-hs , hello! Could you please tell me if there are plans to update the jsoup version in the latest or a new version of the library? The one currently in use contains a vulnerability
@jasmith-hs , hello! Could you please tell me if there are plans to update the jsoup version in the latest or a new version of the library? The one currently in use contains a vulnerability
Activity
Hamilcar31 commentedon Oct 12, 2026
The last version of Jinjava contains Jsoup 1.15.3 which has the vulnerability: CVE-2026-75140
TyutterinYakov commentedon Oct 16, 2026
@Hamilcar31
Good afternoon! Either I misunderstood something, or the vulnerability in the latest version of jsoup has actually been fixed. The vulnerability doesn't show up for the latest version in Maven Central either. In other words, it is already possible to upgrade the dependency to one that has no known vulnerabilities
https://nvd.nist.gov/vuln/detail/cve-2026-75140
Hamilcar31 commentedon Oct 20, 2026
@TyutterinYakov
Yes my previous comment was only meant to point out which CVE the jsoup upgrade fixes.
The problem is that jsoup is bundled directly into Jinjava, so we can't just override its version in our own
pom.xml. Even though a fixed jsoup version exists, there's no way for consumers to apply it on their side. We have to wait for a new Jinjava release with the upgraded dependency.Also there's an issue to make jsoup's version overridable from the consuming project: #1343 (that way if another CVE appears we can override the version in the pom.xml)
Zorin95670 commentedon Oct 28, 2026
Hi @jaredstehler or @boulter ,
It's been over a month since this issue was opened, and the vulnerability in the bundled jsoup version (CVE-2026-75140) is still affecting consumers of Jinjava.
Are there any updates on a fix or a planned release?
Given that a fixed version of jsoup is already available, would it be possible to publish a patch release of Jinjava containing only the dependency upgrade to address this CVE, without waiting for a broader release?
This would allow downstream projects to resolve the vulnerability promptly rather than having to wait indefinitely for a fix.
Thanks for your help!
jasmith-hs commentedon Oct 29, 2026
Looking into this now
jasmith-hs commentedon Oct 29, 2026
Closed with the release of Jinjava 2.7.7 and 2.8.5