critical9.8
CVE-2024-46455
unstructured XML External Entity (XXE)
Impact
unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | unstructured | < 0.14.3 | 0.14.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://binarysouljour.me/cve-2024-46455
- https://github.com/Unstructured-IO/unstructured/tree/0.14.2
- https://github.com/advisories/GHSA-32r8-54hf-c9p3
- https://nvd.nist.gov/vuln/detail/CVE-2024-46455
- https://github.com/Unstructured-IO/unstructured/pull/3088
- https://github.com/Unstructured-IO/unstructured/commit/171b5df09fc3346aba8ce91c04de5b3e094a86bd
- https://www.tenable.com/cve/CVE-2024-46455