CVE-2026-71428

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-71428
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71428.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-71428
Aliases
  • GHSA-4mvj-m6j5-pmf7
Published
2026-08-20T16:43:01.306Z
Modified
2026-08-22T03:58:10.941525348Z
Severity
  • 9.3 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N CVSS Calculator
Summary
unstructured: Server-Side Request Forgery in the URL-based partitioning
Details

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partitionhtml, and partitionmd is fetched without host validation in unstructured/partition/auto.py, unstructured/partition/html/partition.py, and unstructured/partition/md.py. An attacker who controls that URL can make a server-side ingestion service request loopback addresses, internal HTTP services, or cloud metadata endpoints through direct targets, redirects, or DNS rebinding. The response body is returned as Element text, allowing internal response disclosure, and side-effecting GET endpoints may also be triggered. This issue is fixed in version 0.24.0.

Database specific 
{
    "cwe_ids": [
        "CWE-601",
        "CWE-918"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71428.json"
}
References

Affected packages

Git / github.com/unstructured-io/unstructured

Affected ranges

Type
GIT
Repo
https://github.com/unstructured-io/unstructured
Events
Introduced
962de78def1d34aad1ee5acc2ab7804367d49180
Fixed
445c95735c4045057f51f399bc04c657751923bd
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0.4.7"
        },
        {
            "fixed": "0.24.0"
        }
    ]
}

Affected versions

0.*
0.10.0
0.10.1
0.10.10
0.10.11
0.10.12
0.10.13
0.10.14
0.10.15
0.10.16
0.10.17
0.10.18
0.10.19
0.10.2
0.10.20
0.10.21
0.10.22
0.10.23
0.10.24
0.10.25
0.10.26
0.10.27
0.10.28
0.10.29
0.10.30
0.10.4
0.10.5
0.10.6
0.10.7
0.10.8
0.10.9
0.11.0
0.11.1
0.11.2
0.11.4
0.11.5
0.11.6
0.11.7
0.11.8
0.12.0
0.12.1
0.12.2
0.12.3
0.12.4
0.12.5
0.12.6
0.13.0
0.13.1
0.13.2
0.13.3
0.13.4
0.13.5
0.13.6
0.13.7
0.14.0
0.14.1
0.14.10
0.14.2
0.14.3
0.14.4
0.14.5
0.14.6
0.14.7
0.14.8
0.14.9
0.15.0
0.15.1
0.15.10
0.15.12
0.15.13
0.15.14
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
0.15.8
0.15.9
0.16.0
0.16.1
0.16.11
0.16.12
0.16.13
0.16.14
0.16.15
0.16.16
0.16.17
0.16.19
0.16.2
0.16.20
0.16.21
0.16.22
0.16.23
0.16.24
0.16.25
0.16.3
0.16.4
0.16.5
0.16.6
0.16.7
0.16.8
0.17.0
0.17.11-dev1
0.17.2
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.15
0.18.18
0.18.2
0.18.20
0.18.21
0.18.22
0.18.24
0.18.26
0.18.27
0.18.28
0.18.3
0.18.31
0.18.32
0.18.4
0.18.5
0.18.6
0.18.7
0.18.9
0.19.3
0.20.1
0.20.6
0.20.8
0.21.0
0.21.1
0.21.2
0.21.5
0.22.10
0.22.12
0.22.16
0.22.18
0.22.20
0.22.21
0.22.22
0.22.23
0.22.26
0.22.27
0.22.28
0.22.29
0.22.30
0.22.31
0.22.32
0.22.4
0.22.6
0.23.0
0.23.1
0.4.10
0.4.11
0.4.12
0.4.13
0.4.14
0.4.15
0.4.16
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.5.10
0.5.11
0.5.12
0.5.13
0.5.2
0.5.3
0.5.4
0.5.6
0.5.7
0.5.8
0.5.9
0.6.0
0.6.1
0.6.10
0.6.11
0.6.12
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.6.8
0.6.9
0.7.0
0.7.1
0.7.10
0.7.11
0.7.12
0.7.2
0.7.4
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.0
0.8.1-docs-rebuild
0.8.2
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.9.0
0.9.0-docs-build
0.9.1
0.9.2
0.9.3
opencv-4.*
opencv-4.12.0.88
unstructured_0.*
unstructured_0.18.14

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71428.json"