CVE-2024-46455 unstructured XML External Entity (XXE)
Attackers can exploit XML External Entity vulnerabilities in the unstructured library's XMLParser to read sensitive data or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-46455?
CVE-2024-46455 is a critical vulnerability in n/a, published on 9 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser.
Weakness: CWE-611
Which versions are affected by CVE-2024-46455?
4 open source packages ship an affected version, including unstructured and github.com/Unstructured-IO/unstructured.
| Package | Affected | Fixed in |
|---|---|---|
unstructured PyPI | All versions | 0.14.3 |
unstructured PyPI | All versions | 0.14.3 |
unstructured PyPI | All versions | 0.14.3 |
github.com/Unstructured-IO/unstructured Go | All versions | None |
How do I fix CVE-2024-46455?
Upgrade unstructured to 0.14.3 or later.
Is CVE-2024-46455 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-46455 exists.
Sources
Also known as GHSA-32r8-54hf-c9p3, GO-2024-3315, PYSEC-2026-1993.