GHSA-V5MQ-3XHG-98M9 unstructured: Stored XSS via unescaped HTML generation

Summary When unstructured parses an untrusted document and outputs the result as HTML, malicious markup contained in the document e.g. is left in the output HTML without escaping. When that output is displayed in a browser, the script embedded in the document executes in the viewer's browser...

EUVD-2026-98918

unstructured: Stored XSS via unescaped HTML generation...

CVE-2026-104250

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to 0.24.1, partitionhtmlhtmlparserversion="v2" and the VLM partitioner can preserve untrusted document tags, attributes, text, a...

CVE-2026-104250

The unstructured library is vulnerable to Stored XSS prior to version 0.24.1 . The root cause is that the to_html() path in unstructured/documents/ontology.py fails to escape output or reject unsafe URL schemes when using partition_html(html_parser_version="v2") or the VLM partitioner . This allo...

CVE-2026-104250 unstructured: Stored XSS via unescaped HTML generation

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to 0.24.1, partitionhtmlhtmlparserversion="v2" and the VLM partitioner can preserve untrusted document tags, attributes, text, a...

CVE-2026-104250 unstructured: Stored XSS via unescaped HTML generation

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to 0.24.1, partitionhtmlhtmlparserversion="v2" and the VLM partitioner can preserve untrusted document tags, attributes, text, a...

CVE-2026-104250

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to 0.24.1, partitionhtmlhtmlparserversion="v2" and the VLM partitioner can preserve untrusted document tags, attributes, text, a...

CVE-2026-104250: Improper Neutralization of Input During Web Page Generation

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to 0.24.1, partitionhtmlhtmlparserversion="v2" and the VLM partitioner can preserve untrusted document tags, attributes, text, a...

Unstructured output processing vulnerability

Versions of Unstructured prior to 0.24.1 contain security vulnerabilities. These vulnerabilities stem from the fact that the partitionhtml and VLM partitioner retain untrusted document tags, attributes, texts, and link targets in metadata.textashtml. Additionally, the tohtml function in...

CVE-2026-71428

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partitionhtml, and partitionmd is fetched without host validation in...