The unstructured library opens a severe vulnerability that permits a server‑side request forgery when the url parameter is given to the partition, partition_html, or partition_md functions. An attacker who can control the URL can cause the ingestion service to reach internal loopback or private network addresses, hit internal HTTP services, or access cloud metadata endpoints. The library returns the fetched response body as Element text, leaking internal data to the caller, and it also triggers any side‑effecting GET endpoints that the target may run. The result is a compromise of confidentiality, integrity, or availability of internal resources and data.

Unstructured‑IO:unstructured is the impacted product. Versions from 0.4.7 up to (but not including) 0.24.0 contain the flaw. The fix was applied in release 0.24.0, which removes host validation for the url argument in the relevant modules.

The CVSS score of 9.3 demonstrates an extremely high severity rating, and the lack of an EPSS entry does not indicate low probability; the attack remains feasible for any system that exposes the unstructured library to input it does not fully trust. While the vulnerability is not listed in CISA’s KEV catalog, the combination of an unvalidated outbound request and the ability to read the response invites a broad range of potential attacks. An attacker who can supply a crafted URL to the ingestion service—either directly or via a higher‑level application—can exploit this flaw to proxy internal traffic, exfiltrate data, or trigger internal services. The risk is highest against services that process user‑supplied URLs without performing host validation or network restrictions.