CVE-2026-104250

Name of the Vulnerable Software and Affected Versions unstructured versions prior to 0.24.1

Description The library fails to properly escape output or reject unsafe URL schemes in the to html() path within unstructured/documents/ontology.py. This allows untrusted document tags, attributes, text, and link targets to be preserved in metadata.text as html when using partition html(html parser version="v2") and the VLM partitioner. Additionally, elements to html() emits these results as an HTML document. Consequently, event-handler attributes, attribute breakout markup, and javascript: links can survive parsing, enabling attacker-controlled scripts to execute in the viewer's origin when the generated HTML is rendered in a browser.

Recommendations Update to version 0.24.1.