Live › vulnerability › CVE-2026-120416
The Python library newspaper4k fetches image URLs found in articles without restricting where they point, so a crafted page can make the server send requests to internal hosts. An attacker who can get the application to parse a malicious article can reach services the server itself can see.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 18:24 UTC. All times on this page are UTC.
Applications that use newspaper4k to download and parse articles from URLs that users or outside parties can supply are exposed through the image extractor. Scripts that only parse trusted, fixed content are unlikely to be reachable. unknown for any further detail the sources do not give.
No product ranges from the sources yet.
pip show newspaper4k and compare it to the fixed release.newspaper or newspaper4k that call Article.parse on user-supplied URLs.0.9.6.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security vulnerability has been detected in AndyFactory newspaper4k up to 0.9.6. This affects the function Article.parse of the file newspaper/extractors/image_extractor.py of the component Image Extractor. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. Upgrading to version 0.9.6.1 mitigates this issue. The name of the patch is eec5fab21897c14667c98f5ba1831ebd3a692dd4. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
This page as .md · .json · in your agent: get_signal("CVE-2026-120416")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.