CVE-2026-71428: Unstructured partition server-side request forgery

CVE-2026-71428 · Severity: critical · CVSS 9.3 · Published 2026-08-20

Unstructured is a Python library used to parse and extract text from various document formats, widely integrated into AI frameworks like LangChain and LlamaIndex. The library's URL-based document parsing functions contain a critical vulnerability that allows attackers to read internal services, cloud metadata endpoints (AWS, GCP, Azure), and sensitive credentials without authentication. An attacker can supply a malicious URL pointing to internal network resources or cloud metadata services, and the response body is returned to the attacker, enabling full data exfiltration.

Technologies: unstructured (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-71428 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-71428 being exploited in the wild.
How severe is CVE-2026-71428?
Critical severity, with a CVSS score of 9.3, published 20 August 2026.
Which products and versions are affected?
unstructured (PyPI) >= 0.4.7, < 0.24.0, ECOSYSTEM:introduced=0.4.7,fixed=0.24.0.
Is there a fix for CVE-2026-71428?
Yes. unstructured (PyPI): upgrade to 0.24.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71428 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-71428?
Check whether you run unstructured (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • unstructured (PyPI): upgrade to 0.24.0 or later
    pip install "unstructured>=0.24.0"

Technical details

A full-read server-side request forgery (SSRF) vulnerability exists in three URL fetching functions: `partition()` via `file_and_type_from_url()` (unstructured/partition/auto.py:303), `partition_html()` (unstructured/partition/html/partition.py:160), and `partition_md()` (unstructured/partition/md.py:96). The `url=` parameter is fetched via `requests.get()` with no validation of the target host, allowing attackers to specify private IP addresses, redirect chains, or use DNS rebinding to reach internal services. The response body is returned as Element text, enabling full content exfiltration. No host validation (is_private, is_loopback, ipaddress checks) or redirect restrictions exist in any of the three vulnerable functions. Exploitation requires only a network-reachable application using these functions; no authentication or user interaction is required. Affected versions 0.4.7 through 0.23.x (approximately 219 releases) have contained the vulnerability since February 2023. Version 0.24.0 and later contain the fix.

Affected products

  • Unstructured-IO unstructured >= 0.4.7, < 0.24.0

Identifiers

  • CVE-2026-71428
  • GHSA-4mvj-m6j5-pmf7
  • PYSEC-2026-3930

Timeline

  • 2026-09-03: disclosed: Vulnerability disclosed on GitHub Advisory Database
  • 2026-07-10: patched: Patch released in version 0.24.0; GitHub review timestamp
  • 2023-02: other: Vulnerability introduced in version 0.4.7 (February 2023)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.