CVE-2026-71428

CVE-2026-71428 is a server-side request forgery in the open-source `unstructured` Python document-partitioning library, where the `url=` parameter of `partition()`, `partition_html()`, and `partition_md()` is fetched with `requests.get()` without any private-IP, loopback, scheme, or redirect validation. An attacker who can control that URL — directly or through downstream ingestion layers such as LangChain's UnstructuredURLLoader, LlamaIndex's UnstructuredReader, or Chainlit — can point it at loopback admin APIs, internal HTTP services, or cloud metadata endpoints, and because the response body is returned as document Element text the SSRF is fully readable; redirect-following (on by default) and DNS rebinding provide bypass paths, and the markdown path also lacks a timeout, enabling slow-loris denial of service. An attacker gains the ability to read internal network responses, including secrets such as cloud credentials from metadata services (CVSS 3.1 9.3 Critical, scope-changed, C:H/I:L). Any deployment of the library from version 0.4.7 (Feb 2023) through the current release line (verified on 0.22.26 and still unfixed on main at commit 199f255) is affected — roughly 219 releases with no validation ever added — especially RAG and agent pipelines that ingest user-supplied URLs. There is no evidence of in-the-wild exploitation (EPSS ~0.3%, not in CISA KEV), and no public PoC is known beyond the reporter's local demonstration.

What to do: No fixed release is identified in the available data; monitor the unstructured project and upgrade as soon as a patched version is published. Until then, avoid passing attacker-controlled URLs to partition()/partition_html()/partition_md(), restrict fetched URLs to an allowlist of public hosts (blocking private, loopback and link-local IP ranges, and re-resolving DNS at connect time to prevent rebinding), and consider allow_redirects=False to close the redirect bypass. Teams using LangChain's UnstructuredURLLoader, LlamaIndex's UnstructuredReader, or Chainlit should audit whether end users can control the fetched URL.