Description
The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to 0.24.1, partition_html(html_parser_version="v2") and the VLM partitioner can preserve untrusted document tags, attributes, text, and link targets in metadata.text_as_html, while elements_to_html() emits the result as an HTML document. The to_html() path in unstructured/documents/ontology.py does not escape output or reject unsafe URL schemes, allowing event-handler attributes, attribute breakout markup, and javascript: links to survive parsing. When the generated HTML or text_as_html is rendered in a browser, attacker-controlled script can execute in the viewer's origin, including in document-ingestion workflows where a privileged reviewer opens submitted content. This issue is fixed in version 0.24.1.
Published: 2026-10-13
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Script Execution via Stored XSS
Action: Apply Patch
AI Analysis

Impact

A stored cross‑site scripting vulnerability exists in the unstructured library. The parser can preserve untrusted tags, attributes, text, and links in the metadata.text_as_html field, and the to_html() function emits this unescaped HTML, failing to reject unsafe URL schemes. This allows event‑handler attributes, attribute breakout markup, and javascript: links to survive parsing. When the generated HTML is rendered in a browser, attacker‑controlled script runs in the viewer’s origin, potentially affecting privileged reviewers who open submitted content.

Affected Systems

The flaw is present in any deployment using Unstructured‑IO’s unstructured library prior to version 0.24.1, including the partition_html and VLM partitioner components. The vulnerability is fixed in releases 0.24.1 and later.

Risk and Exploitability

The CVSS score of 6.1 indicates moderate severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog. An attacker who can supply a malicious document to an ingestion workflow can exploit the flaw; the rendered output can execute arbitrary JavaScript in the context of the viewer’s origin.

Generated by OpenCVE AI on October 13, 2026 at 17:57 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the unstructured library to version 0.24.1 or later.
  • Verify that no user‑generated content is processed by the to_html() path or that the output is escaped before being rendered in a browser.
  • Review and harden document ingestion workflows so that privileged reviewers cannot view untrusted rendered HTML.

Generated by OpenCVE AI on October 13, 2026 at 17:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-v5mq-3xhg-98m9 unstructured: Stored XSS via unescaped HTML generation
History

Wed, 14 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
First Time appeared Unstructured-io
Unstructured-io unstructured
Vendors & Products Unstructured-io
Unstructured-io unstructured

Tue, 13 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
Description The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to 0.24.1, partition_html(html_parser_version="v2") and the VLM partitioner can preserve untrusted document tags, attributes, text, and link targets in metadata.text_as_html, while elements_to_html() emits the result as an HTML document. The to_html() path in unstructured/documents/ontology.py does not escape output or reject unsafe URL schemes, allowing event-handler attributes, attribute breakout markup, and javascript: links to survive parsing. When the generated HTML or text_as_html is rendered in a browser, attacker-controlled script can execute in the viewer's origin, including in document-ingestion workflows where a privileged reviewer opens submitted content. This issue is fixed in version 0.24.1.
Title unstructured: Stored XSS via unescaped HTML generation
Weaknesses CWE-116
CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Unstructured-io Unstructured
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-14T15:32:42.130Z

Reserved: 2026-10-01T19:04:39.706Z

Link: CVE-2026-104250

cve-icon Vulnrichment

Updated: 2026-10-14T15:32:26.141Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T17:17:15.900

Modified: 2026-10-16T16:00:33.533

Link: CVE-2026-104250

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T18:45:15Z

Weaknesses
  • CWE-116

    Improper Encoding or Escaping of Output

  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')