CVE-2026-104250: unstructured Cross-Site Scripting Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-v5mq-3xhg-98m9",
  "modified" : "2026-10-15T20:16:18Z",
  "published" : "2026-10-15T20:16:18Z",
  "aliases" : [ "CVE-2026-104250" ],
  "summary" : "unstructured: Stored XSS via unescaped HTML generation",
  "details" : "### Summary\n\nWhen `unstructured` parses an untrusted document and outputs the result as HTML, malicious markup contained in the document (e.g. `<img src=x onerror=...>`) is left in the output HTML without escaping. When that output is displayed in a browser, the script embedded in the document executes in the viewer's browser.\n\n### Details\n\n`partition_html(html_parser_version=\"v2\")` (and the VLM partitioner) preserve the input document's element tags, attributes, and text into `metadata.text_as_html`, and `elements_to_html()` outputs that as an HTML document.\n\nThe function that builds HTML on this path, `to_html()` in `unstructured/documents/ontology.py`, performs no escaping at all. As a result, event handlers such as `onerror` / `onmouseover` / `onload` originating from the input document are left in the output HTML as-is (literal `<script>` tags are stripped by the parser, but attribute-based vectors and `javascript:` URLs are not). In addition, link URLs are not scheme-filtered, so `<a href=\"javascript:...\">` is also emitted.\n\nRelevant source: `documents/ontology.py` (`to_html`, `_construct_attribute_string`, `_generate_final_html`); `partition/html/transformations.py` (`text_as_html = ontology_element.to_html()`); `partition/html/convert.py` (`elements_to_html`).\n\n### PoC\n\nEnvironment: `downloads.unstructured.io/unstructured-io/unstructured:latest`, `unstructured` 0.23.3.\n\n```python\nfrom unstructured.partition.html import partition_html\nfrom unstructured.partition.html.convert import elements_to_html\n\nmalicious = ('<body class=\"Document\">'\n             '<p class=\"Paragraph\" onmouseover=\"alert(1)\">hello'\n             '<img src=x onerror=\"alert(document.domain)\"></p>'\n             '<a class=\"Hyperlink\" href=\"javascript:alert(document.cookie)\">click me</a>'\n             '</body>')\nels = partition_html(text=malicious, html_parser_version=\"v2\")\nopen(\"xss_output.html\", \"w\").write(elements_to_html(list(els), no_group_by_page=True))\n```\n\n`elements_to_html()` output body — the unescaped vectors survive:\n\n```html\n<p class=\"NarrativeText\" id=\"...\" onmouseover=\"alert(1)\">\n  <p class=\"Paragraph\">hello</p>\n  <img class=\"Image\" onerror=\"alert(document.domain)\" src=\"x\"/>\n</p>\n<a class=\"UncategorizedText\" href=\"javascript:alert(document.cookie)\" id=\"...\">click me</a>\n```\n\nOpening `xss_output.html` in a browser fires `alert` automatically (via `<img onerror>`), with no interaction. Per-vector confirmation (each payload labelled, each verified in a browser):\n\n| Vector | Trigger | Cause |\n|---|---|---|\n| `<img onerror>` | open file (auto) | element `text` not escaped |\n| `<svg onload>` (via `title='\"><svg ...>'`) | open file (auto) | attribute value not escaped (`\"` breakout) |\n| `<a href=javascript:>` | click | link URL scheme not filtered |\n| `onmouseover` | hover | source attribute preserved as-is |\n\n### Impact\n\nStored XSS caused by improper output encoding. Anyone who renders the HTML or `text_as_html` generated from an untrusted document is affected. In an ingestion pipeline where uploaded documents are parsed and a staff member reviews their contents in a web UI, a low-privileged or external submitter can inject malicious HTML; when a privileged reviewer later opens the parsed result, `<img onerror>` fires in their session with no interaction, leading to cross-record information disclosure and privileged actions.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "unstructured"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.24.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.24.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/Unstructured-IO/unstructured/security/advisories/GHSA-v5mq-3xhg-98m9"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-104250"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Unstructured-IO/unstructured/pull/4394"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Unstructured-IO/unstructured/commit/cda16b3f2170019be9c6ea5635946fb3eaa2d66f"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/Unstructured-IO/unstructured"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Unstructured-IO/unstructured/releases/tag/0.24.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-116", "CWE-79" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-10-15T20:16:18Z",
    "nvd_published_at" : "2026-10-13T17:17:15Z"
  }
}