CVE-2026-71428

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partition_html, and partition_md is fetched without host validation in unstructured/partition/auto.py, unstructured/partition/html/partition.py, and unstructured/partition/md.py. An attacker who controls that URL can make a server-side ingestion service request loopback addresses, internal HTTP services, or cloud metadata endpoints through direct targets, redirects, or DNS rebinding. The response body is returned as Element text, allowing internal response disclosure, and side-effecting GET endpoints may also be triggered. This issue is fixed in version 0.24.0.

• CWE-601
• CWE-918

• https://github.com/Unstructured-IO/unstructured/commit/445c95735c4045057f51f399bc04c657751923bd
• https://github.com/Unstructured-IO/unstructured/pull/4388
• https://github.com/Unstructured-IO/unstructured/releases/tag/0.24.0
• https://github.com/Unstructured-IO/unstructured/security/advisories/GHSA-4mvj-m6j5-pmf7

Published

Aug 20, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-71415Kirby is an open-source content management system. From 5.0.…7.1
• CVE-2026-71416Headroom compresses data before the data reaches a large lan…8.8
• CVE-2026-71417Lemur manages TLS certificate creation. Prior to 1.9.3, POST…7.3
• CVE-2026-71418Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2026-7142A vulnerability was determined in Wooey up to 0.13.2. The im…6.3
• CVE-2026-71424Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14,…9.6
• CVE-2026-71429stream-json is a micro-library of stream components for proc…6.2
• CVE-2026-7143A vulnerability was identified in 1000 Projects Portfolio Ma…6.3
• CVE-2026-71430node-re2 provides RE2 regular expression bindings for Node.j…6.2
• CVE-2026-71433LangGraph Checkpoint Postgres and SQLite Checkpoint are the …5.3
• CVE-2026-71434Statamic is a Laravel and Git powered content management sys…5.3
• CVE-2026-71435Statamic is a Laravel and Git powered content management sys…6.1