Read the docs
TI-2026-71944 Aliases CVE-2026-104250GHSA-v5mq-3xhg-98m9

Stored cross-site scripting in unstructured HTML generation

Priority MEDIUM 60CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

The unstructured library before 0.24.1 does not escape HTML generated from untrusted documents or reject unsafe URL schemes. An unauthenticated remote attacker can submit a crafted document that keeps event-handler attributes, attribute breakout markup and javascript: links in the generated HTML. When a user such as a document reviewer opens that HTML, attacker script runs in the viewer's origin (CWE-79).

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to 0.24.1, partition_html(html_parser_version="v2") and the VLM partitioner can preserve untrusted document tags, attributes, text, and link targets in metadata.text_as_html, while elements_to_html() emits the result as an HTML document. The to_html() path in unstructured/documents/ontology.py does not escape output or reject unsafe URL schemes, allowing event-handler attributes, attribute breakout markup, and javascript: links to survive parsing. When the generated HTML or text_as_html is rendered in a browser, attacker-controlled script can execute in the viewer's origin, including in document-ingestion workflows where a privileged reviewer opens submitted content. This issue is fixed in version 0.24.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00234 14th percentileScored 2026-11-07
Fix Fixed unstructured (Unstructured-IO): 0.24.1unstructured (PyPI): 0.24.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Unstructured-IOunstructuredbefore 0.24.10.24.1Patch availableCNA
—unstructured (PyPI)before 0.24.10.24.1Patch availableGHSA-v5mq-3xhg-98m9
  • unstructured VendorUnstructured-IO Affected before 0.24.1 Fixed in 0.24.1 Patch available CNA
  • unstructured (PyPI) Vendor— Affected before 0.24.1 Fixed in 0.24.1 Patch available GHSA-v5mq-3xhg-98m9

Remediation

Upgrade the unstructured package to version 0.24.1, which the sources list as the fixed version in both the Unstructured-IO and PyPI entries.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA unstructured (Unstructured-IO) Fixed in 0.24.1
  • Fix · GHSA-v5mq-3xhg-98m9 unstructured (PyPI) Fixed in 0.24.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-104250
  2. 2026-10-14 CISA SSVC decision points changed
  3. 2026-10-16 Alias added: GHSA-v5mq-3xhg-98m9
  4. 2026-10-16 Fix available: PyPI/[email protected] · GHSA-v5mq-3xhg-98m9
  5. 2026-10-16 CVSS score added · GHSA-v5mq-3xhg-98m9
  6. 2026-10-16 Weakness changed · GHSA-v5mq-3xhg-98m9
  7. 2026-10-16 6 new references · GHSA-v5mq-3xhg-98m9
  8. 2026-11-06 Affected versions changed · Red Hat
  9. 2026-11-06 CVSS score added · Red Hat

References

Advisory 1

Other 5

  • TI-2026-50050 unstructured: Server-Side Request Forgery in the URL-based partitioning CVSS 3.1CRITICAL 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences