Is CVE-2022-36033 actively exploited?

No active exploitation of CVE-2022-36033 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2022-36033 be exploited remotely?

Yes. CVE-2022-36033 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2022-36033?

CVE-2022-36033 has a CVSS score of 6.1 (MEDIUM).

HOME VULNERABILITIESCVE-2022-36033

MEDIUM

CVE-2022-36033

CWE-79Published: August 29, 2022· Updated: Jun 17, 2026

6.1

CVSS v3.1

Official Description

jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety. jsoup may incorrectly sanitize HTML including `javascript:` URL expressions, which could allow XSS attacks when a reader subsequently clicks that link. If the non-default `SafeList.preserveRelativeLinks` option is enabled, HTML including `javascript:` URLs that have been crafted with control characters will not be sanitized. If the site that this HTML is published on does not set a Content Security Policy, an XSS attack is then possible. This issue is patched in jsoup 1.15.3. Users should upgrade to this version. Additionally, as the unsanitized input may have been persisted, old content should be cleaned again using the updated version. To remediate this issue without immediately upgrading: - disable `SafeList.preserveRelativeLinks`, which will rewrite input URLs as absolute URLs - ensure an appropriate [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) is defined. (This should be used regardless of upgrading, as a defence-in-depth best practice.)

NVD Source

Technical Analysis

CVE-2022-36033 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.

From a weakness classification perspective (CWE-79): Cross-site scripting (XSS) vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users.