CVE-2026-104250: unstructured: Stored XSS via unescaped HTML generation
The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to 0.24.1, partitionhtml(htmlparserversion="v2") and the VLM partitioner can preserve untrusted document tags, attributes, text, and link targets in metadata.textashtml, while elementstohtml() emits the result as an HTML document. The tohtml() path in unstructured/documents/ontology.py does not escape output or reject unsafe URL schemes, allowing event-handler attributes, attribute breakout markup, and javascript: links to survive parsing. When the generated HTML or textashtml is rendered in a browser, attacker-controlled script can execute in the viewer's origin, including in document-ingestion workflows where a privileged reviewer opens submitted content. This issue is fixed in version 0.24.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
unstructuredto a version that resolves this vulnerability.Fixed in 0.24.1
Event History
Frequently Asked Questions
Which deployments are realistically exposed to script execution?
Deployments are exposed when they process untrusted documents with partition_html(html_parser_version="v2") or the VLM partitioner and later render metadata.text_as_html or HTML produced by elements_to_html() in a browser. Document-ingestion workflows are particularly affected if a privileged reviewer opens submitted content.
What does an attacker need to exploit this issue?
An attacker needs to supply content that is processed by an affected parsing path and have the resulting generated HTML rendered by a browser. The vulnerable output can retain event-handler attributes, attribute-breakout markup, and javascript: link targets.
Does exploitation require authentication or direct interaction with the vulnerable service?
The provided vector indicates no privileges are required and the attack can be delivered over the network, but user interaction is required. In practice, a viewer must render the attacker-controlled generated HTML or text_as_html.
What version fixes the issue?
Upgrade unstructured to version 0.24.1 or later. Versions prior to 0.24.1 are affected under the described parsing and rendering conditions.