A stored cross‑site scripting vulnerability exists in the unstructured library. The parser can preserve untrusted tags, attributes, text, and links in the metadata.text_as_html field, and the to_html() function emits this unescaped HTML, failing to reject unsafe URL schemes. This allows event‑handler attributes, attribute breakout markup, and javascript: links to survive parsing. When the generated HTML is rendered in a browser, attacker‑controlled script runs in the viewer’s origin, potentially affecting privileged reviewers who open submitted content.

The flaw is present in any deployment using Unstructured‑IO’s unstructured library prior to version 0.24.1, including the partition_html and VLM partitioner components. The vulnerability is fixed in releases 0.24.1 and later.

The CVSS score of 6.1 indicates moderate severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog. An attacker who can supply a malicious document to an ingestion workflow can exploit the flaw; the rendered output can execute arbitrary JavaScript in the context of the viewer’s origin.