---
id: CVE-2024-46455
aliases:
  - GHSA-32r8-54hf-c9p3
  - GO-2024-3315
  - PYSEC-2026-1993
title: unstructured XML External Entity (XXE)
summary: unstructured XML External Entity (XXE)
severity: medium
vendor: unstructured
product: unstructured
ecosystem: pip
affected:
  - unstructured < 0.14.3
patched:
  - unstructured 0.14.3
published: '2024-12-09'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-32r8-54hf-c9p3'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-46455'
  - url: 'https://github.com/Unstructured-IO/unstructured/pull/3088'
  - url: >-
      https://github.com/Unstructured-IO/unstructured/commit/171b5df09fc3346aba8ce91c04de5b3e094a86bd
  - url: 'https://binarysouljour.me/cve-2024-46455'
  - url: 'https://github.com/Unstructured-IO/unstructured'
  - url: 'https://www.tenable.com/cve/CVE-2024-46455'
tags:
  - osv
  - pip
epss: 0.00566
epssPercentile: 0.4573
ingestedAt: '2026-07-08T18:25:44.649Z'
---

## Overview

unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser.

## Affected packages

- `unstructured < 0.14.3`

## Remediation

Upgrade to a patched release:

- `unstructured 0.14.3`