GHSA-v5mq-3xhg-98m9: XSS
Summary
When unstructured parses an untrusted document and outputs the result as HTML, malicious markup contained in the document (e.g. <img src=x onerror=...>) is left in the output HTML without escaping. When that output is displayed in a browser, the script embedded in the document executes in the viewer's browser.
Details
partitionhtml(htmlparserversion="v2") (and the VLM partitioner) preserve the input document's element tags, attributes, and text into metadata.textashtml, and elementstohtml() outputs that as an HTML document.
The function that builds HTML on this path, tohtml() in unstructured/documents/ontology.py, performs no escaping at all. As a result, event handlers such as onerror / onmouseover / onload originating from the input document are left in the output HTML as-is (literal <script> tags are stripped by the parser, but attribute-based vectors and javascript: URLs are not). In addition, link URLs are not scheme-filtered, so <a href="javascript:..."> is also emitted.
Relevant source: documents/ontology.py (tohtml, constructattributestring, generatefinalhtml); partition/html/transformations.py (textashtml = ontologyelement.tohtml()); partition/html/convert.py (elementstohtml).
PoC
Environment: downloads.unstructured.io/unstructured-io/unstructured:latest, unstructured 0.23.3.
python from unstructured.partition.html import partitionhtml from unstructured.partition.html.convert import elementstohtml
malicious = ('<body class="Document">' '<p class="Paragraph" onmouseover="alert(1)">hello' '<img src=x onerror="alert(document.domain)"></p>' '<a class="Hyperlink" href="javascript:alert(document.cookie)">click me</a>' '</body>') els = partitionhtml(text=malicious, htmlparserversion="v2") open("xssoutput.html", "w").write(elementstohtml(list(els), nogroupbypage=True))
elementstohtml() output body — the unescaped vectors survive:
html <p class="NarrativeText" id="..." onmouseover="alert(1)"> <p class="Paragraph">hello</p> <img class="Image" onerror="alert(document.domain)" src="x"/> </p> <a class="UncategorizedText" href="javascript:alert(document.cookie)" id="...">click me</a>
Opening xssoutput.html in a browser fires alert automatically (via <img onerror>), with no interaction. Per-vector confirmation (each payload labelled, each verified in a browser):
| Vector | Trigger | Cause | |---|---|---| | <img onerror> | open file (auto) | element text not escaped | | <svg onload> (via title='"><svg ...>') | open file (auto) | attribute value not escaped (" breakout) | | <a href=javascript:> | click | link URL scheme not filtered | | onmouseover | hover | source attribute preserved as-is |
Impact
Stored XSS caused by improper output encoding. Anyone who renders the HTML or textashtml generated from an untrusted document is affected. In an ingestion pipeline where uploaded documents are parsed and a staff member reviews their contents in a web UI, a low-privileged or external submitter can inject malicious HTML; when a privileged reviewer later opens the parsed result, <img onerror> fires in their session with no interaction, leading to cross-record information disclosure and privileged actions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/unstructuredto a version that resolves this vulnerability.Fixed in 0.24.1
Event History
Frequently Asked Questions
Which processing paths are affected?
The affected path includes partition_html(html_parser_version="v2") and the VLM partitioner when their output is rendered through elements_to_html(). These paths preserve source tags, attributes, and text in metadata.text_as_html and emit them without escaping.
What does an attacker need to exploit this?
An attacker needs to supply a document containing malicious HTML markup and have the generated HTML displayed in a browser. No authentication is required by the vulnerability vector, but user interaction is required for a viewer to open or otherwise render the output.
Are script tags the only concern when reviewing documents?
No. Although literal script tags are stripped by the parser, event-handler attributes such as onerror, onmouseover, and onload can remain, as can javascript: URLs in link href attributes.