unstructured EUVD-2026-98918

Exploitation requires three concrete conditions: (1) the affected code path must be used - specifically partition_html(html_parser_version="v2") or the VLM partitioner, since these populate metadata.text_as_html via the unescaped to_html() routine in unstructured/documents/ontology.py; (2) the pipeline must emit or surface that output (elements_to_html() or metadata.text_as_html); and (3) a victim must render the generated HTML in a browser (UI:R), typically a privileged reviewer opening attacker-submitted content in a document-ingestion workflow. Limiting factors: the attacker only controls document content and cannot directly reach the victim - exploitation is second-order and depends on the output being displayed as live HTML; installations on 0.24.1 or later are not affected; pipelines that never render the HTML output in a browser, or that use only the v1 parser path, are not exposed.

This is a stored/DOM cross-site scripting flaw (CWE-79) rated CVSS 6.1 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The signals are internally consistent: network-reachable, low complexity, no attacker authentication required (PR:N), but it does require victim interaction (UI:R) - a privileged reviewer must render the generated HTML/text_as_html in a browser. The scope change (S:C) correctly reflects that attacker script executes in the viewer's browser origin rather than in the library process itself, which is why confidentiality and integrity are rated Low and availability None. No EPSS score, CISA KEV listing, or public proof-of-concept exploit was provided in the input, so there is no public exploit identified at time of analysis; the only exploitation evidence is the vendor fix (sanitization added via nh3 allowlisting) and its regression tests demonstrating the dangerous payload classes (on* handlers, javascript:/data: URIs, tag/attribute breakout). This is a real but conditional issue rather than a drop-everything emergency: it is a classic second-order XSS whose impact hinges on an untrusted document reaching a trusted rendering surface, so prioritize it specifically in RAG/document-ingestion pipelines that display text_as_html or elements_to_html() output to human reviewers, and lower it where output is never rendered as live HTML in a browser.

An attacker submits a crafted document (e.g. HTML, or content processed by the VLM partitioner) containing event-handler attributes, attribute-breakout markup, or a javascript: link. A pre-0.24.1 unstructured pipeline partitions it with html_parser_version="v2" and stores the unescaped markup in metadata.text_as_html / elements_to_html() output. When a privileged reviewer later opens that generated HTML in a browser, the attacker-controlled script executes in the viewer's origin. No public exploit is identified, but vendor regression tests demonstrate the exact payload classes.