Threats tagged 'ghsa-v5mq-3xhg-98m9'

CVE-2026-104250 is a stored cross-site scripting (XSS) vulnerability in the unstructured library prior to version 0.24.1. When unstructured parses untrusted HTML documents and outputs them as HTML, it fails to escape malicious markup such as event handlers (e.g., onerror, onmouseover) and javascript: URLs. This allows embedded scripts to execute automatically in a viewer's browser when the output is rendered. The vulnerability affects the to_html() function and related HTML output paths. Exploitation can occur without user interaction, leading to information disclosure and potential privileged actions in ingestion pipelines where untrusted documents are reviewed in a web UI.