CVE-2026-104250

MediumCVSS 6.1

Published: 13/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 13/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

The unstructured library prior to 0.24.1 does not escape output in the to_html() path in ontology.py, allowing untrusted document tags, attributes, and javascript: links to survive in metadata.text_as_html. When the generated HTML is rendered in a browser, attacker-controlled script can execute in the viewer's origin.

Risk Assessment

Script execution in the browser of a person viewing a processed document can lead to session or data theft, especially in document-ingestion workflows handled by privileged reviewers.

Recommendation

Update the unstructured library to version 0.24.1 or later and avoid rendering untrusted HTML/text_as_html without additional sanitization.

Other vulnerabilities in unstructured

CVE-2026-71428Critical
In the unstructured library (from 0.4.7 to 0.24.0), the url argument in partition, partition_html, and partition_md is fetched without host validation, allowing an attacker to access loopback addresses, internal HTTP services, or cloud metadata endpoints.

Original NVD description (English source)

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to 0.24.1, partition_html(html_parser_version="v2") and the VLM partitioner can preserve untrusted document tags, attributes, text, and link targets in metadata.text_as_html, while elements_to_html() emits the result as an HTML document. The to_html() path in unstructured/documents/ontology.py does not escape output or reject unsafe URL schemes, allowing event-handler attributes, attribute breakout markup, and javascript: links to survive parsing. When the generated HTML or text_as_html is rendered in a browser, attacker-controlled script can execute in the viewer's origin, including in document-ingestion workflows where a privileged reviewer opens submitted content. This issue is fixed in version 0.24.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS