CVE-2026-120416
Received Received - Intake

Server-Side Request Forgery in AndyFactory newspaper4k

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulDB

Description
A security vulnerability has been detected in AndyFactory newspaper4k up to 0.9.6. This affects the function Article.parse of the file newspaper/extractors/image_extractor.py of the component Image Extractor. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. Upgrading to version 0.9.6.1 mitigates this issue. The name of the patch is eec5fab21897c14667c98f5ba1831ebd3a692dd4. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120416

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Server-Side Request Forgery (SSRF) in the newspaper4k library up to version 0.9.6. It occurs in the Article.parse function of the image_extractor.py component. The issue allows attackers to trick the library into making requests to internal hosts by manipulating image URLs in article content. The vulnerability was fixed in version 0.9.6.1.

Detection Guidance

To detect this SSRF vulnerability in newspaper4k up to 0.9.6, check if your application uses the library and if image fetching is enabled. Inspect network logs for outbound requests to private or internal IPs (e.g., 127.0.0.1, 10.x.x.x, 192.168.x.x) originating from the application. Use tools like tcpdump or Wireshark to monitor unexpected internal requests. Verify library version with pip show newspaper4k or check import statements in code.

Impact Analysis

An attacker could exploit this to access internal systems, bypass firewalls, or interact with private services like cloud metadata endpoints. This may lead to data leaks, unauthorized access, or further attacks on internal networks. The impact depends on the network configuration and services exposed.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements for safeguarding sensitive health information. Organizations may face compliance violations if exploited.

Mitigation Strategies

Upgrade to newspaper4k version 0.9.6.1 or later immediately. If upgrading is not possible, disable image fetching by setting fetch_images=False in your configuration. Alternatively, manually validate all URLs before processing them. Ensure network-level restrictions are in place to block internal requests from the application.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120416. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...