Executive brief
Unstructured is a Python library used to parse and extract text from various document formats, widely integrated into AI frameworks like LangChain and LlamaIndex. The library's URL-based document parsing functions contain a critical vulnerability that allows attackers to read internal services, cloud metadata endpoints (AWS, GCP, Azure), and sensitive credentials without authentication. An attacker can supply a malicious URL pointing to internal network resources or cloud metadata services, and the response body is returned to the attacker, enabling full data exfiltration.
Technical details
A full-read server-side request forgery (SSRF) vulnerability exists in three URL fetching functions: `partition()` via `file_and_type_from_url()` (unstructured/partition/auto.py:303), `partition_html()` (unstructured/partition/html/partition.py:160), and `partition_md()` (unstructured/partition/md.py:96). The `url=` parameter is fetched via `requests.get()` with no validation of the target host, allowing attackers to specify private IP addresses, redirect chains, or use DNS rebinding to reach internal services. The response body is returned as Element text, enabling full content exfiltration. No host validation (is_private, is_loopback, ipaddress checks) or redirect restrictions exist in any of the three vulnerable functions. Exploitation requires only a network-reachable application using these functions; no authentication or user interaction is required. Affected versions 0.4.7 through 0.23.x (approximately 219 releases) have contained the vulnerability since February 2023. Version 0.24.0 and later contain the fix.
Affected products
- Unstructured-IO unstructured >= 0.4.7, < 0.24.0
Timeline
- 2026-09-03: disclosed: Vulnerability disclosed on GitHub Advisory Database
- 2026-07-10: patched: Patch released in version 0.24.0; GitHub review timestamp
- 2023-02: other: Vulnerability introduced in version 0.4.7 (February 2023)