{"id":"CVE-2024-46455","aliases":["EUVD-2024-3415","GHSA-32r8-54hf-c9p3","GO-2024-3315","PYSEC-2026-1993","openSUSE-SU-2024:14599-1"],"status":"published","title":"unstructured XML External Entity (XXE)","description":"unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00566,"percentile":0.47302,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2024-12-09T00:00:00Z","modified":"2026-07-07T17:56:53Z","fixes":[{"ecosystem":"PyPI","package":"unstructured","fixed_in":["0.14.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"unstructured","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"unstructured","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.3"}]}],"versions":["0.0.1.dev0","0.10.0","0.10.1","0.10.10","0.10.11","0.10.12","0.10.13","0.10.14","0.10.15","0.10.16","0.10.18","0.10.19","0.10.19.dev18","0.10.2","0.10.20","0.10.21","0.10.22","0.10.23","0.10.24","0.10.25","0.10.26","0.10.27","0.10.28","0.10.29","0.10.30","0.10.4","0.10.5","0.10.6","0.10.7","0.10.8","0.10.9","0.11.0","0.11.1","0.11.2","0.11.4","0.11.5","0.11.6","0.11.7","0.11.8","0.12.0","0.12.2","0.12.3","0.12.4","0.12.5","0.12.6","0.13.0","0.13.1","0.13.2","0.13.3","0.13.4","0.13.5","0.13.6","0.13.7","0.14.0","0.14.2","0.14.2.dev1","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6.dev1","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.4.0","0.4.1","0.4.10","0.4.11","0.4.12","0.4.13","0.4.14","0.4.15","0.4.16","0.4.2","0.4.3","0.4.4","0.4.6","0.4.7","0.4.8","0.4.9","0.5.0","0.5.1","0.5.10","0.5.11","0.5.12","0.5.13","0.5.2","0.5.3","0.5.4","0.5.6","0.5.7","0.5.8","0.5.9","0.6.0","0.6.1","0.6.10","0.6.11","0.6.2","0.6.3","0.6.4","0.6.5","0.6.6","0.6.7","0.6.8","0.6.9","0.7.0","0.7.1","0.7.10","0.7.11","0.7.12","0.7.2","0.7.3","0.7.4","0.7.5","0.7.6","0.7.7","0.7.8","0.7.9","0.8.0","0.8.1","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.8.8","0.9.0","0.9.1","0.9.2","0.9.3"]},{"source":"osv","ecosystem":"Go","package":"github.com/Unstructured-IO/unstructured","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"unstructured","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.3"}]}],"versions":["0.0.1.dev0","0.10.0","0.10.1","0.10.10","0.10.11","0.10.12","0.10.13","0.10.14","0.10.15","0.10.16","0.10.18","0.10.19","0.10.19.dev18","0.10.2","0.10.20","0.10.21","0.10.22","0.10.23","0.10.24","0.10.25","0.10.26","0.10.27","0.10.28","0.10.29","0.10.30","0.10.4","0.10.5","0.10.6","0.10.7","0.10.8","0.10.9","0.11.0","0.11.1","0.11.2","0.11.4","0.11.5","0.11.6","0.11.7","0.11.8","0.12.0","0.12.2","0.12.3","0.12.4","0.12.5","0.12.6","0.13.0","0.13.1","0.13.2","0.13.3","0.13.4","0.13.5","0.13.6","0.13.7","0.14.0","0.14.2","0.14.2.dev1","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6.dev1","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.4.0","0.4.1","0.4.10","0.4.11","0.4.12","0.4.13","0.4.14","0.4.15","0.4.16","0.4.2","0.4.3","0.4.4","0.4.6","0.4.7","0.4.8","0.4.9","0.5.0","0.5.1","0.5.10","0.5.11","0.5.12","0.5.13","0.5.2","0.5.3","0.5.4","0.5.6","0.5.7","0.5.8","0.5.9","0.6.0","0.6.1","0.6.10","0.6.11","0.6.2","0.6.3","0.6.4","0.6.5","0.6.6","0.6.7","0.6.8","0.6.9","0.7.0","0.7.1","0.7.10","0.7.11","0.7.12","0.7.2","0.7.3","0.7.4","0.7.5","0.7.6","0.7.7","0.7.8","0.7.9","0.8.0","0.8.1","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.8.8","0.9.0","0.9.1","0.9.2","0.9.3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241213T205935-1.1"}]}],"bundled":21}],"references":[{"url":"https://github.com/Unstructured-IO/unstructured/tree/0.14.2","tags":["web"]},{"url":"https://binarysouljour.me/cve-2024-46455","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46455","tags":["advisory"]},{"url":"https://github.com/Unstructured-IO/unstructured/pull/3088","tags":["web"]},{"url":"https://github.com/Unstructured-IO/unstructured/commit/171b5df09fc3346aba8ce91c04de5b3e094a86bd","tags":["web"]},{"url":"https://www.tenable.com/cve/CVE-2024-46455","tags":["web"]},{"url":"https://github.com/advisories/GHSA-32r8-54hf-c9p3","tags":["advisory"]},{"url":"https://github.com/Unstructured-IO/unstructured","tags":["package"]},{"url":"https://pypi.org/project/unstructured","tags":["package"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QTUY324RV3FFZBHVIWDHRCIOPJHIJIN4/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-26248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46455","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55660","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-46455","description":"unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser.","status":"published","published":"2024-12-09T00:00:00Z","modified":"2024-12-11T20:29:44.658Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:34:08.843708Z"}],"euvd":[{"id":"EUVD-2024-3415","description":"unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser.","status":"published","published":"2024-12-09T00:00:00Z","modified":"2024-12-11T20:29:44Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:04:36.46341Z"}],"ghsa":[{"id":"GHSA-32r8-54hf-c9p3","title":"unstructured XML External Entity (XXE)","description":"unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser.","status":"published","published":"2024-12-09T21:31:02Z","modified":"2024-12-10T19:18:16Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:38:24.542211Z"}],"nvd":[{"id":"CVE-2024-46455","description":"unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser.","status":"published","published":"2024-12-09T21:15:08.367Z","modified":"2026-06-17T07:55:23.98Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:10:39.434419Z"}],"osv":[{"id":"GHSA-32r8-54hf-c9p3","title":"unstructured XML External Entity (XXE)","description":"unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser.","status":"published","published":"2024-12-09T21:31:02Z","modified":"2026-07-07T17:56:53.00644784Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:35.050232Z"},{"id":"PYSEC-2026-1993","title":"unstructured XML External Entity (XXE)","description":"unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser.","status":"published","published":"2026-07-07T14:34:47.039912Z","modified":"2026-07-07T17:56:53.00644784Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"GO-2024-3315","title":"CVE-2024-46455 in github.com/Unstructured-IO/unstructured","description":"CVE-2024-46455 in github.com/Unstructured-IO/unstructured","status":"published","published":"2024-12-10T21:29:10Z","modified":"2026-07-07T17:56:53.00644784Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2024:14599-1","title":"govulncheck-vulndb-0.0.20241213T205935-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20241213T205935-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-18T00:00:00Z","modified":"2026-02-04T02:20:26.243259Z","updated_at":"2026-11-02T16:58:36.976155Z"}]}}