- Latest release
- 0.27.37 (Nov 6, 2026): no advisory affects it
- Newest unaffected release
- 0.27.37 (Nov 6, 2026), the latest release
- Advisories
- 4 · 3 critical, 1 medium
- Weekly downloads
- 581.8K
- Dependents
- 172
- Releases
- 249 since 0.2.0 (Sep 26, 2022)
- Registry
- PyPI
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-104250Affects 0.0.1.dev0 to 0.24.0 (0.24.1 is outside it)
- CVE-2026-71428Affects 0.4.7 to 0.23.1 (0.24.0 is outside it)
- CVE-2025-64712Affects 0.0.1.dev0 to 0.18.15 (0.18.18 is outside it)
- CVE-2024-46455Affects 0.0.1.dev0 to 0.14.2 (0.14.3 is outside it)
Advisories 4
- CVE-2026-104250Medium 6.1
unstructured: Stored XSS via unescaped HTML generation
Affected: fixed in 0.24.1.
Fixed in 0.24.1 (released Jul 11, 2026, 94 days before disclosure).
The latest release, 0.27.37, is not affected.
- CVE-2026-71428Critical 9.3
unstructured: Server-Side Request Forgery in the URL-based partitioning
Affected: from 0.4.7, fixed in 0.24.0.
Fixed in 0.24.0 (released Jul 6, 2026, 45 days before disclosure).
The latest release, 0.27.37, is not affected.
- CVE-2025-64712Critical 9.8
Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write
Affected: fixed in 0.18.18.
Fixed in 0.18.18 (released Nov 7, 2025, 89 days before disclosure).
The latest release, 0.27.37, is not affected.
- CVE-2024-46455Critical 9.8
unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser.
Affected: fixed in 0.14.3.
Fixed in 0.14.3 (released May 29, 2024, 194 days before disclosure).
The latest release, 0.27.37, is not affected.