Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
When unstructured parses an untrusted document and outputs the result as HTML, malicious markup contained in the document (e.g. <img src=x onerror=...) is left in the output HTML without escaping. When that output is displayed in a browser, the script embedded in the document executes in the viewer's browser. Details partitionhtml(htmlparserversion="v2") (and the VLM partitioner) preserve the input document's element tags, attributes, and text into metadata.textashtml, and elementstohtml() outputs that as an HTML document. The function that builds HTML on this path, tohtml() in unstructured/documents/ontology.py, performs no escaping at all. As a result, event handlers such as onerror / onmouseover / onload originating from the input document are left in the output HTML as-is (literal <script tags are stripped by the parser, but attribute-based vectors and javascript: URLs are not). In addition, link URLs are not scheme-filtered, so <a href="javascript:..." is also emitted.…
Recommended action: Upgrade to 0.24.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Server-Side Request Forgery in unstructured. The url= argument of partition(), partitionhtml(), and partitionmd() is fetched via requests.get() with no host validation. The response body is returned as Element text, so this is a full-read SSRF — attackers reach loopback admin APIs, internal HTTP services, and cloud metadata endpoints, and read the response. unstructured is the de facto URL ingestion layer for LangChain UnstructuredURLLoader, LlamaIndex UnstructuredReader, Chainlit, and many agent frameworks — secure defaults must live in the library, not in every downstream caller. Details Three sinks, all in unstructured == 0.22.26 (verified on main at 199f255): - unstructured/partition/auto.py:303 — fileandtypefromurl(), reached via partition(url=…). - unstructured/partition/html/partition.py:160 — partitionhtml(url=…). Post-fetch Content-Type check runs after the request hits the target. - unstructured/partition/md.py:96 — partitionmd(url=…). No timeout (SSRF + slow-loris…
Recommended action: Upgrade to 0.24.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Path Traversal vulnerability in the partitionmsg function allows an attacker to write or overwrite arbitrary files on the filesystem when processing malicious MSG files with attachments. Impact An attacker can craft a malicious .msg file with attachment filenames containing path traversal sequences (e.g., ../../../etc/cron.d/malicious). When processed with processattachments=True, the library writes the attachment to an attacker-controlled path, potentially leading to: - Arbitrary file overwrite - Remote code execution (via overwriting configuration files, cron jobs, or Python packages) - Data corruption - Denial of service Affected Functionality The vulnerability affects the MSG file partitioning functionality when processattachments=True is enabled. Vulnerability Details The library does not sanitize attachment filenames in MSG files before using them in file write operations, allowing directory traversal sequences to escape the intended output directory. Workarounds…
Recommended action: Upgrade to 0.18.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser.
Recommended action: Upgrade to 0.14.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.