CVE-2026-104250: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Unstructured-IO unstructured

The unstructured library, used for ingesting and pre-processing various document formats, had a vulnerability in its HTML partitioning and rendering functions before version 0.24.1. Specifically, the to_html() function in unstructured/documents/ontology.py fails to escape output or reject unsafe URL schemes, allowing event-handler attributes, attribute breakout markup, and javascript: links to remain in the generated HTML. This improper neutralization of input (CWE-79) enables cross-site scripting attacks when the HTML is rendered in a browser, including scenarios where privileged users review submitted content. The vulnerability is addressed by updating to version 0.24.1.

An attacker can inject malicious scripts into the HTML output generated by the unstructured library, which execute in the security context of the user viewing the rendered content. This can lead to information disclosure or other client-side impacts within document ingestion workflows. The CVSS 3.1 score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact.

Upgrade the unstructured library to version 0.24.1 or later, where this vulnerability is fixed. No additional mitigation is required once the update is applied.