Unstructured library flaw can leak internal server data

Published September 3, 2026 CVE-2026-71428

A popular open-source library called Unstructured, used to pull text out of PDFs, Word files, and web pages for AI systems, can be tricked into fetching internal web addresses instead of the file it was told to grab. The text it reads back, including from internal services or cloud account data, gets handed straight to whoever submitted the link.

Severity
CriticalCVSS 3.1 · 9.3
Fix
Fixed in 0.24.0Fix recorded on Sep 3, 2026
Affected versions
0.4.7 or newer, but before 0.24.0
Weakness
CWE-601Open Redirect
Exploit likelihood
0.25% in 30 daysEPSS, higher than 16% of known flaws
Affects
Unstructured-IO

How it works

When a developer's app lets someone submit a web link for Unstructured to fetch and read as a document, the library grabs that link without checking whether it points somewhere it shouldn't, so a submitted link, a redirect, or a trick with DNS can steer the request to internal servers, local network addresses, or a cloud provider's private data service...

What to do

Check the installed version with python3 -m pip show unstructured and compare it against the 0.4.7 to 0.24.0 affected range. If your code passes user-supplied URLs into partition, partition_html, or partition_md, you are exposed.

Run this in the application environment you want to check:

python3 -m pip show unstructured

Update to unstructured version 0.24.0 or later with python3 -m pip install -U unstructured, and until you can update, avoid passing untrusted or user-submitted URLs into these functions or restrict outbound requests from the service running them.

Technical details

Affected software: Unstructured-IO

CVE-2026-71428 (CVSS 9.3) is a server-side request forgery flaw in the unstructured library's URL-based partitioning path. The url argument accepted by partition, partition_html, and partition_md in unstructured/partition/auto.py, html/partition.py, and md.py is fetched with no host validation, so direct targets, HTTP redirects, or DNS rebinding can redirect the request to loopback addresses, internal services, or cloud metadata endpoints. The fetched response body is returned as Element text to the caller, and because the request is a real GET, it can also trigger side effects on any internal endpoint that acts on GET requests. Fixed in 0.24.0.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact Low Some data can be modified
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N Open in FIRST.org calculator

References

View Original Source