CVE-2026-71428

Name of the Vulnerable Software and Affected Versions unstructured versions 0.4.7 through 0.23.x

Description The library fails to validate the host when fetching the url argument in the partition(), partition html(), and partition md() functions. This allows an attacker to force the server-side ingestion service to make requests to loopback addresses, internal HTTP services, or cloud metadata endpoints via direct targets, redirects, or DNS rebinding. Consequently, the response body is returned as Element text, which can lead to the disclosure of internal responses or the triggering of side-effecting GET endpoints.

Recommendations Update to version 0.24.0.