CVE-2026-104250 unstructured: Stored XSS via unescaped HTML generation
Attackers can execute arbitrary scripts in a viewer's browser via unescaped HTML in the unstructured library, risking account takeover in document workflows.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-104250?
CVE-2026-104250 is a medium-severity cross-site scripting vulnerability in Unstructured-IO unstructured, published on 13 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to 0.24.1, partition_html(html_parser_version="v2") and the VLM partitioner can preserve untrusted document tags, attributes, text, and link targets in metadata.text_as_html, while elements_to_html() emits the result as an HTML document. The to_html() path in unstructured/documents/ontology.py does not escape output or reject unsafe URL schemes, allowing event-handler attributes, attribute breakout markup, and javascript: links to survive parsing. When the generated HTML or text_as_html is rendered in a browser, attacker-controlled script can execute in the viewer's origin, including in document-ingestion workflows where a privileged reviewer opens submitted content. This issue is fixed in version 0.24.1.
Which versions are affected by CVE-2026-104250?
2 open source packages ship an affected version, including unstructured.
| Package | Affected | Fixed in |
|---|---|---|
unstructured PyPI | All versions | 0.24.1 |
unstructured PyPI | All versions | 0.24.1 |
How do I fix CVE-2026-104250?
Upgrade unstructured to 0.24.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-104250 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-104250 exists.
Sources
Also known as GHSA-v5mq-3xhg-98m9.