CVE-2026-104250

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-104250
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104250.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-104250
Aliases
Published
2026-10-13T16:29:28Z
Modified
2026-10-16T02:31:10Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
unstructured: Stored XSS via unescaped HTML generation
Details

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to 0.24.1, partition_html(html_parser_version="v2") and the VLM partitioner can preserve untrusted document tags, attributes, text, and link targets in metadata.text_as_html, while elements_to_html() emits the result as an HTML document. The to_html() path in unstructured/documents/ontology.py does not escape output or reject unsafe URL schemes, allowing event-handler attributes, attribute breakout markup, and javascript: links to survive parsing. When the generated HTML or text_as_html is rendered in a browser, attacker-controlled script can execute in the viewer's origin, including in document-ingestion workflows where a privileged reviewer opens submitted content. This issue is fixed in version 0.24.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-116",
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104250.json"
}
References

Affected packages

Git / github.com/unstructured-io/unstructured

Affected ranges

Type
GIT
Repo
https://github.com/unstructured-io/unstructured
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cda16b3f2170019be9c6ea5635946fb3eaa2d66f
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "0.24.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.10.0
0.10.1
0.10.10
0.10.11
0.10.12
0.10.13
0.10.14
0.10.15
0.10.16
0.10.17
0.10.18
0.10.19
0.10.2
0.10.20
0.10.21
0.10.22
0.10.23
0.10.24
0.10.25
0.10.26
0.10.27
0.10.28
0.10.29
0.10.30
0.10.4
0.10.5
0.10.6
0.10.7
0.10.8
0.10.9
0.11.0
0.11.1
0.11.2
0.11.4
0.11.5
0.11.6
0.11.7
0.11.8
0.12.0
0.12.1
0.12.2
0.12.3
0.12.4
0.12.5
0.12.6
0.13.0
0.13.1
0.13.2
0.13.3
0.13.4
0.13.5
0.13.6
0.13.7
0.14.0
0.14.1
0.14.10
0.14.2
0.14.3
0.14.4
0.14.5
0.14.6
0.14.7
0.14.8
0.14.9
0.15.0
0.15.1
0.15.10
0.15.12
0.15.13
0.15.14
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
0.15.8
0.15.9
0.16.0
0.16.1
0.16.11
0.16.12
0.16.13
0.16.14
0.16.15
0.16.16
0.16.17
0.16.19
0.16.2
0.16.20
0.16.21
0.16.22
0.16.23
0.16.24
0.16.25
0.16.3
0.16.4
0.16.5
0.16.6
0.16.7
0.16.8
0.17.0
0.17.11-dev1
0.17.2
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.15
0.18.18
0.18.2
0.18.20
0.18.21
0.18.22
0.18.24
0.18.26
0.18.27
0.18.28
0.18.3
0.18.31
0.18.32
0.18.4
0.18.5
0.18.6
0.18.7
0.18.9
0.19.3
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.20.1
0.20.6
0.20.8
0.21.0
0.21.1
0.21.2
0.21.5
0.22.10
0.22.12
0.22.16
0.22.18
0.22.20
0.22.21
0.22.22
0.22.23
0.22.26
0.22.27
0.22.28
0.22.29
0.22.30
0.22.31
0.22.32
0.22.4
0.22.6
0.23.0
0.23.1
0.24.0
0.3.0
0.3.1
0.3.2
0.3.3
0.3.4
0.3.5
0.4.0
0.4.1
0.4.10
0.4.11
0.4.12
0.4.13
0.4.14
0.4.15
0.4.16
0.4.2
0.4.3
0.4.4
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.5.10
0.5.11
0.5.12
0.5.13
0.5.2
0.5.3
0.5.4
0.5.6
0.5.7
0.5.8
0.5.9
0.6.0
0.6.1
0.6.10
0.6.11
0.6.12
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.6.8
0.6.9
0.7.0
0.7.1
0.7.10
0.7.11
0.7.12
0.7.2
0.7.4
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.0
0.8.1-docs-rebuild
0.8.2
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.9.0
0.9.0-docs-build
0.9.1
0.9.2
0.9.3
opencv-4.*
opencv-4.12.0.88
unstructured_0.*
unstructured_0.18.14

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104250.json"