CVE-2026-104250: Unstructured Library XSS Vulnerability

CVE-2026-104250 Overview

CVE-2026-104250 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in the unstructured library, an open-source toolkit for ingesting and pre-processing documents such as PDFs, HTML, and Word files. Versions prior to 0.24.1 fail to sanitize untrusted document content in partition_html(html_parser_version="v2") and the Visual Language Model (VLM) partitioner. The to_html() path in unstructured/documents/ontology.py preserves event-handler attributes and javascript: URL schemes without escaping output. Attacker-controlled script executes in the viewer's origin when generated HTML renders in a browser.

Critical Impact
Attackers can execute arbitrary JavaScript in document-ingestion workflows when a privileged reviewer opens attacker-submitted content, enabling session hijacking and data theft.

Affected Products

Unstructured-IO unstructured library versions prior to 0.24.1
Deployments using partition_html(html_parser_version="v2")
Deployments using the VLM partitioner that render metadata.text_as_html or elements_to_html() output

Discovery Timeline

2026-10-13 - CVE-2026-104250 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-104250

Vulnerability Analysis

The unstructured library processes documents and emits structured representations including an HTML view through metadata.text_as_html and elements_to_html(). When operating with html_parser_version="v2" or the VLM partitioner, the library preserves tags, attributes, text content, and link targets drawn from untrusted source documents. The to_html() serializer in unstructured/documents/ontology.py writes these values directly into HTML output without escaping or scheme filtering.

Document-ingestion pipelines commonly surface this HTML to human reviewers or downstream applications. Any resulting script execution runs in the viewer's browser origin, which may include administrative dashboards, data lake frontends, or AI pipeline review tools.

Root Cause

The root cause is missing output encoding and URL-scheme validation in the HTML serialization layer. The to_html() function trusts parsed ontology nodes and renders them verbatim. Event-handler attributes such as onerror, onload, and onclick survive the pipeline, as do javascript: URIs within anchor href and other link-bearing attributes. Attribute-breakout markup is also preserved, allowing attackers to escape attribute contexts.

Attack Vector

An attacker crafts a document containing malicious HTML elements, event handlers, or javascript: links and submits it to a workflow that uses the affected partitioners. Ingestion stores the hostile markup inside metadata.text_as_html. When a reviewer or downstream service renders that field, the attacker's script executes with the privileges of the viewer. The attack requires user interaction to render the output, but the ingestion step itself does not require authentication in many deployments.

text

// Patch excerpt from pyproject.toml (adds nh3 HTML sanitizer dependency)
     "html5lib>=1.1, <2.0.0",
     "langdetect>=1.0.9, <2.0.0",
     "lxml>=5.0.0, <7.0.0",
+    "nh3>=0.3.0, <1.0.0",
     "spacy>=3.7.0, <4.0.0",
     "installer>=0.7.0, <1.0.0",
     "numba>=0.60.0, <1.0.0",
// Source: GitHub commit cda16b3f2170019be9c6ea5635946fb3eaa2d66f

The fix introduces nh3, a Rust-based HTML sanitization library, to strip unsafe tags, attributes, and URL schemes from v2 HTML output before serialization.

Detection Methods for CVE-2026-104250

Indicators of Compromise

Stored metadata.text_as_html records containing event-handler attributes such as onerror=, onload=, or onclick=.
Anchor or link elements with href values beginning with javascript: or data:text/html.
Unexpected <script> tags embedded in ingested document HTML representations.
Browser console errors or outbound requests originating from reviewer sessions after opening ingested content.

Detection Strategies

Scan the installed unstructured package version across build artifacts and container images; flag any release below 0.24.1.
Run pattern-based inspection over stored partitioner output for inline event handlers and dangerous URL schemes.
Deploy a Content Security Policy (CSP) on reviewer interfaces and alert on CSP violation reports.

Monitoring Recommendations

Log and review all documents submitted to ingestion endpoints, correlating submitter identity with downstream reviewer sessions.
Monitor browser-origin outbound requests from internal document review tools for anomalous destinations.
Track dependency manifests through Software Composition Analysis (SCA) tooling to detect vulnerable unstructured versions in continuous integration.

How to Mitigate CVE-2026-104250

Immediate Actions Required

Upgrade the unstructured library to version 0.24.1 or later across all ingestion services and worker images.
Rebuild and redeploy container images and serverless functions that bundle the vulnerable release.
Audit stored metadata.text_as_html records produced by vulnerable versions and purge or re-sanitize entries before serving them to reviewers.

Patch Information

The fix is released in unstructured v0.24.1. The patch adds the nh3 sanitizer dependency and routes v2 HTML output through it. Reference the GitHub Security Advisory GHSA-v5mq-3xhg-98m9, Pull Request #4394, and commit cda16b3f for implementation details.

Workarounds

Avoid calling partition_html with html_parser_version="v2" and disable the VLM partitioner until upgrade is complete.
Post-process metadata.text_as_html and elements_to_html() output with an HTML sanitizer such as nh3 or bleach before storage or rendering.
Enforce a strict Content Security Policy on reviewer interfaces that blocks inline scripts and javascript: URIs.

bash

# Upgrade to the patched release
pip install --upgrade "unstructured>=0.24.1"

# Verify the installed version
python -c "import unstructured; print(unstructured.__version__)"