AndyFactory newspaper4k Image Extractor image_extractor.py Article.parse server-side request forgery
newspaper4k's Article.parse fetches image URLs from article content and checks only the URL scheme, so crafted articles can reach internal hosts. Fixed in 0.9.6.1.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 0.9.6.1
- Who is exposed
- Default setups
Do first: Check every install: default setups are affected.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 29/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Default setups
- Fix
- Fixed in 0.9.6.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The newspaper4k Python library (AndyFactory's fork of newspaper, used for extracting article content and images) is affected by a server-side request forgery flaw in its image extraction component. An attacker who can supply article URLs could trick the server running the software into making unintended requests to internal or other systems, potentially exposing internal resources or data.
Read the original description
A security vulnerability has been detected in AndyFactory newspaper4k up to 0.9.6. This affects the function Article.parse of the file newspaper/extractors/image_extractor.py of the component Image Extractor. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. Upgrading to version 0.9.6.1 mitigates this issue. The name of the patch is eec5fab21897c14667c98f5ba1831ebd3a692dd4. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
What to do
Check every install: default setups are affected.
Upgrade to a fixed version: 0.9.6.1.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- AndyFactory newspaper4k
0.9.0, 0.9.1, 0.9.2, 0.9.3, 0.9.4, 0.9.5, 0.9.6
Evidence 8
- Advisory
- Advisory
- Advisory
- Advisory
- Patch
Show all 8 sourcesShow fewer sources
- Patch
- Report
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-120416
What does this mean?
Article.parse only checks the URL scheme of image links it fetches from article content. A crafted article can therefore make the library send requests to internal hosts on the server's network.Source: github.com
Am I affected, and how do I check?
The product is newspaper4k from AndyFactory, and the issue applies when Article.parse runs with image fetching enabled, which is on by default. The checked facts do not list an affected version range, so check the installed newspaper4k version and whether image fetching is turned on.Source: github.com
What should I do about it?
Upgrade newspaper4k to 0.9.6.1, which the advisory cites as the release that solves the issue.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data