Intel

AIKIDO-2024-10150

unstructured is vulnerable to Information Disclosure

Information Disclosure Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.
Published Jun 28, 2024

40

Medium Risk

This Affects:

pythonunstructured
0.6.7 - 0.14.7
Fixed in 0.14.8
Are you affected? Scan for Free

TL;DR

Affected versions of unstructured do not mark some sensitive fields, which means they may end up in logging systems.

Who does this affect?

You are affected if you use a vulnerable version of unstructured.

Background info

unstructured is vulnerable to Information Disclosure in versions 0.6.7 - 0.14.7.

How to fix this

Upgrade unstructured to a patch version.