Cross-Site Scripting Vulnerability in Unstructured Library Affecting Open-Source Document Processing
CVE-2026-104250
6.1MEDIUM
What is CVE-2026-104250?
The unstructured library for open-source document processing, which handles diverse formats like PDFs and HTML, contains vulnerabilities in its parsing methods. Specifically, prior to version 0.24.1, the library's partition_html and VLM partitioner options were able to retain untrusted elements, allowing unsafe attributes and links to persist in metadata. This oversight could lead to script execution in browsers when the resulting HTML is rendered, posing risks especially during document ingestion processes where privileged reviewers could inadvertently activate malicious code. This issue has been mitigated in version 0.24.1.
Affected Version(s)
unstructured < 0.24.1