unstructured XML External Entity (XXE)

CRÍTICO 9.8CVE-2024-46455 · GHSA-32r8-54hf-c9p3 · GO-2024-3315 · Published 09/12/2024 · updated 17/06/2026

En resumen

CVE-2024-46455 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a github.com/Unstructured-IO/unstructured, unstructured.
Probabilidad de explotación en los próximos 30 días (EPSS): 0.57%, mayor que el 47.0% de las vulnerabilidades.
Solución: actualizar a 0.14.3 o posterior.

Package	Affected versions	Patched versions
github.com/Unstructured-IO/unstructured Go	`all versions`	No fix yet
unstructured PyPI	`< 0.14.3`	`0.14.3`

unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser.

NVD description

unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.