Description

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partition_html, and partition_md is fetched without host validation in unstructured/partition/auto.py, unstructured/partition/html/partition.py, and unstructured/partition/md.py. An attacker who controls that URL can make a server-side ingestion service request loopback addresses, internal HTTP services, or cloud metadata endpoints through direct targets, redirects, or DNS rebinding. The response body is returned as Element text, allowing internal response disclosure, and side-effecting GET endpoints may also be triggered. This issue is fixed in version 0.24.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-20T17:19:40.773Z",
  "pubdate": "2026-08-20T17:19:40.773Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in the unstructured open-source library affecting versions from 0.4.7 up to 0.24.0. The vulnerability resides within the url argument handling during the ingestion and pre-processing of documents across multiple partition functions. Specifically, lack of adequate host validation allows malicious actors who control the targeted URL input to force the ingestion service to issue arbitrary HTTP GET requests to internal network resources, loopback addresses, and cloud metadata endpoints. This exposes internal services, facilitates internal response disclosure by returning response bodies as Element text, and can trigger unintended side-effecting GET endpoints. The risk implications are severe, potentially granting attackers unauthorized visibility into restricted internal architecture and cloud environments through direct requests, HTTP redirects, or DNS rebinding techniques. Exploitation requires the attacker to supply a crafted URL to the vulnerable ingestion interface, relying on the server to execute the outbound request on their behalf.",
  "technicalDetails": "The vulnerability stems from insufficient input sanitization and a complete lack of host validation on the url argument within document partitioning routines. The affected components include unstructured/partition/auto.py, unstructured/partition/html/partition.py, and unstructured/partition/md.py, specifically impacting the partition, partition_html, and partition_md functions. When these functions process documents via URL ingestion, they initiate outbound HTTP requests without verifying whether the destination resolves to a public address, private IP space, loopback interface, or cloud provider metadata service.\nThe attack flow proceeds as follows: First, an unauthenticated or privileged attacker (depending on the API exposure) supplies a malicious URL to the vulnerable partition function. This URL can point directly to internal resources, leverage HTTP redirect chains to bypass rudimentary filters, or employ DNS rebinding techniques to resolve internal IP addresses after initial validation passes. Second, the unstructured library executes a GET request to the attacker-supplied destination from the context of the host server. Third, internal services, local loopback interfaces, or cloud metadata endpoints process the request and return sensitive data. Fourth, the application captures the response body and incorporates it directly into the generated Element text without filtering or restriction. Finally, the internal response content is returned to the user or processed as document content, leading to internal response disclosure. Furthermore, because the underlying mechanism utilizes HTTP GET requests, state-changing or side-effecting GET endpoints on internal web applications can be inadvertently triggered, causing unintended administrative actions or data alterations within the internal network perimeter."
}