{"id":"CVE-2024-46455","aliases":["GHSA-32r8-54hf-c9p3","GO-2024-3315","PYSEC-2026-1993"],"title":"unstructured XML External Entity (XXE)","summary":"unstructured XML External Entity (XXE)","severity":"medium","vendor":"unstructured","product":"unstructured","ecosystem":"pip","affected":["unstructured < 0.14.3"],"patched":["unstructured 0.14.3"],"published":"2024-12-09","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-32r8-54hf-c9p3","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46455"},{"url":"https://github.com/Unstructured-IO/unstructured/pull/3088"},{"url":"https://github.com/Unstructured-IO/unstructured/commit/171b5df09fc3346aba8ce91c04de5b3e094a86bd"},{"url":"https://binarysouljour.me/cve-2024-46455"},{"url":"https://github.com/Unstructured-IO/unstructured"},{"url":"https://www.tenable.com/cve/CVE-2024-46455"}],"tags":["osv","pip"],"epss":0.00566,"epssPercentile":0.4573,"ingestedAt":"2026-07-08T18:25:44.649Z","slug":"CVE-2024-46455","body":"## Overview\n\nunstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser.\n\n## Affected packages\n\n- `unstructured < 0.14.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `unstructured 0.14.3`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}