---
id: CVE-2026-104250
title: >-
  The unstructured library provides open-source components for ingesting and
  pre-processing images and text documents, such as PDFs, HTML, Word docs, and
  many more
summary: >-
  The unstructured library provides open-source components for ingesting and
  pre-processing images and text documents, such as PDFs, HTML, Word docs, and
  many more. Prior to 0.24.1, partition_html(html_parser_version="v2") and the
  VLM part…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
  - CWE-116
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T17:17:15.900'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-104250'
references:
  - url: >-
      https://github.com/Unstructured-IO/unstructured/commit/cda16b3f2170019be9c6ea5635946fb3eaa2d66f
    label: security-advisories@github.com
  - url: 'https://github.com/Unstructured-IO/unstructured/pull/4394'
    label: security-advisories@github.com
  - url: 'https://github.com/Unstructured-IO/unstructured/releases/tag/0.24.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/Unstructured-IO/unstructured/security/advisories/GHSA-v5mq-3xhg-98m9
    label: security-advisories@github.com
tags:
  - nvd
ingestedAt: '2026-10-13T17:38:53.177Z'
---

## Overview

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to 0.24.1, partition_html(html_parser_version="v2") and the VLM partitioner can preserve untrusted document tags, attributes, text, and link targets in metadata.text_as_html, while elements_to_html() emits the result as an HTML document. The to_html() path in unstructured/documents/ontology.py does not escape output or reject unsafe URL schemes, allowing event-handler attributes, attribute breakout markup, and javascript: links to survive parsing. When the generated HTML or text_as_html is rendered in a browser, attacker-controlled script can execute in the viewer's origin, including in document-ingestion workflows where a privileged reviewer opens submitted content. This issue is fixed in version 0.24.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.