CVE-2026-104250
Description
A flaw was found in unstructured. The library fails to sanitize untrusted markup, attributes, and link targets when converting parsed document elements into HTML. A remote attacker could exploit this vulnerability by submitting a crafted document that, when processed and rendered in a web browser, triggers Cross-Site Scripting (XSS). This flaw allows the execution of arbitrary script within the viewer's browser session, potentially compromising sensitive user data.
Statement
A moderate-impact cross-site scripting (XSS) flaw was found in the unstructured open-source library, which ingests and pre-processes documents such as PDFs, HTML, and Word files. When unstructured parses an untrusted document and converts the parsed elements into HTML, it does not escape the document's tags, attributes, text, and link targets, and it does not reject unsafe URL schemes; event-handler attributes, attribute-breakout markup, and javascript: links can therefore survive into the generated HTML. A remote, unauthenticated attacker could exploit this by submitting a crafted document that, when the processed output is rendered in a web browser, executes attacker-controlled script in the viewer's browser session - including in document-ingestion workflows where a privileged reviewer opens submitted content - potentially allowing theft of sensitive session data and unauthorized actions in the victim's browser context. This flaw is rated Moderate severity (CVSS 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), consistent with the upstream assessment. No Red Hat products are currently recorded as affected by this flaw; the issue affects the upstream unstructured project directly.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream project has addressed this flaw; users consuming the upstream unstructured package directly should upgrade to a release that includes the upstream fix.
Understanding the Weakness (CWE)
Access Control,Confidentiality
Technical Impact: Bypass Protection Mechanism; Read Application Data
The most common attack performed with cross-site scripting involves the disclosure of private information stored in user cookies, such as session information. Typically, a malicious user will craft a client-side script, which -- when parsed by a web browser -- performs some activity on behalf of the victim to an attacker-controlled system (such as sending all site cookies to a given E-mail address). This could be especially dangerous to the site if the victim has administrator privileges to manage that site. This script will be loaded and run by each user visiting the web site. Since the site requesting to run the script has access to the cookies in question, the malicious script does also.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
In some circumstances it may be possible to run arbitrary code on a victim's computer when cross-site scripting is combined with other flaws, for example, "drive-by hacking."
Confidentiality,Integrity,Availability,Access Control
Technical Impact: Execute Unauthorized Code or Commands; Bypass Protection Mechanism; Read Application Data
The consequence of an XSS attack is the same regardless of whether it is stored or reflected. The difference is in how the payload arrives at the server. XSS can cause a variety of problems for the end user that range in severity from an annoyance to complete account compromise. Some cross-site scripting vulnerabilities can be exploited to manipulate or steal cookies, create requests that can be mistaken for those of a valid user, compromise confidential information, or execute malicious code on the end user systems for a variety of nefarious purposes. Other damaging attacks include the disclosure of end user files, installation of Trojan horse programs, redirecting the user to some other page or site, running "Active X" controls (under Microsoft Internet Explorer) from sites that a user perceives as trustworthy, and modifying presentation of content.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
