Snyk Security Database

@xxxfnbs21/hello-demo is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

unstructured is an A library that prepares raw documents for downstream ML tasks.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via OntologyElement.to_html() in the v2 (ontology) HTML path, which emits untrusted document markup with no output encoding. Attacker-controlled content embedded in a parsed document survives into elements_to_html() and metadata.text_as_html without sanitization, allowing stored XSS payloads - including <img onerror>, <svg onload>, <a href="javascript:">, and on* event handlers - to execute when the HTML output is rendered in a browser.

Affected versions of this package are vulnerable to Uncontrolled Recursion via the TProtocolUtil.skip process. An attacker can cause excessive resource consumption or application crash by sending data with deeply nested structures.