EUVD-2026-98918

unstructured: Stored XSS via unescaped HTML generation...

CVE-2026-104250

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to 0.24.1, partitionhtmlhtmlparserversion="v2" and the VLM partitioner can preserve untrusted document tags, attributes, text, a...

CVE-2026-104250

The unstructured library is vulnerable to Stored XSS prior to version 0.24.1 . The root cause is that the to_html() path in unstructured/documents/ontology.py fails to escape output or reject unsafe URL schemes when using partition_html(html_parser_version="v2") or the VLM partitioner . This allo...

CVE-2026-104250

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to 0.24.1, partitionhtmlhtmlparserversion="v2" and the VLM partitioner can preserve untrusted document tags, attributes, text, a...

CVE-2026-104250: Improper Neutralization of Input During Web Page Generation

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to 0.24.1, partitionhtmlhtmlparserversion="v2" and the VLM partitioner can preserve untrusted document tags, attributes, text, a...

PT-2026-111681

Name of the Vulnerable Software and Affected Versions unstructured versions prior to 0.24.1 Description The library fails to properly escape output or reject unsafe URL schemes in the to html path within unstructured/documents/ontology.py. This allows untrusted document tags, attributes, text, an...

Unstructured output processing vulnerability

Versions of Unstructured prior to 0.24.1 contain security vulnerabilities. These vulnerabilities stem from the fact that the partitionhtml and VLM partitioner retain untrusted document tags, attributes, texts, and link targets in metadata.textashtml. Additionally, the tohtml function in...