Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2026-71428

critical

CVE-2026-71428

unstructured: Server-Side Request Forgery in the URL-based partitioning

Published Modified CWE 601, 918
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

GHSA9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Trivy's own label is CRITICAL. Rated critical by GHSA.

Description

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partition_html, and partition_md is fetched without host validation in unstructured/partition/auto.py, unstructured/partition/html/partition.py, and unstructured/partition/md.py. An attacker who controls that URL can make a server-side ingestion service request loopback addresses, internal HTTP services, or cloud metadata endpoints through direct targets, redirects, or DNS rebinding. The response body is returned as Element text, allowing internal response disclosure, and side-effecting GET endpoints may also be triggered. This issue is fixed in version 0.24.0.

Affected packages and fixed versions

SourcePackageFixed in
pip::GitHub Security Advisory pipunstructured0.24.0
chainguardnemo, open-webui2.7.3-r28 and 1 more
wolfiopen-webui0.11.3-r3
Show all 4 entries from 3 sources
SourcePackageFixed in
pip::GitHub Security Advisory pipunstructured0.24.0
chainguardnemo2.7.3-r28
chainguardopen-webui0.11.3-r3
wolfiopen-webui0.11.3-r3

References

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.