{"id":"CVE-2026-120416","kind":"vulnerability","aliases":["CVE-2026-120416"],"related":[],"title":"newspaper4k: image extractor allows server-side request forgery from article URLs","description":"A security vulnerability has been detected in AndyFactory newspaper4k up to 0.9.6. This affects the function Article.parse of the file newspaper/extractors/image_extractor.py of the component Image Extractor. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. Upgrading to version 0.9.6.1 mitigates this issue. The name of the patch is eec5fab21897c14667c98f5ba1831ebd3a692dd4. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.","summary":"The Python library newspaper4k fetches image URLs found in articles without restricting where they point, so a crafted page can make the server send requests to internal hosts. An attacker who can get the application to parse a malicious article can reach services the server itself can see.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["newspaper4k","package","python","web-scraping"],"not_affected_if":["no-user-supplied-urls","pinned-to-fixed-version"],"how_to_check":"- Check the installed version with `pip show newspaper4k` and compare it to the fixed release.\n- Search the codebase for imports of `newspaper` or `newspaper4k` that call `Article.parse` on user-supplied URLs.","fix":"- newspaper4k: upgrade to `0.9.6.1`","status":"open","published_at":"2026-11-02T18:18:50+00:00","first_seen_at":"2026-11-02T18:24:24+00:00","triaged_at":"2026-11-02T18:24:34+00:00","updated_at":"2026-11-02T18:24:34+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-02T18:24:34Z","model":"claude-haiku-5-5","output":{"fix":"- newspaper4k: upgrade to `0.9.6.1`","reach":"internet","title":"newspaper4k: image extractor allows server-side request forgery from article URLs","impact":"medium","summary":"The Python library newspaper4k fetches image URLs found in articles without restricting where they point, so a crafted page can make the server send requests to internal hosts. An attacker who can get the application to parse a malicious article can reach services the server itself can see.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","newspaper4k","web-scraping"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"server makes requests to internal network hosts on attacker's behalf","analyst_note":"","how_to_check":"- Check the installed version with `pip show newspaper4k` and compare it to the fixed release.\n- Search the codebase for imports of `newspaper` or `newspaper4k` that call `Article.parse` on user-supplied URLs.","plain_action":"","needs_analyst":false,"not_affected_if":["no-user-supplied-urls","pinned-to-fixed-version"],"who_is_affected":"Applications that use newspaper4k to download and parse articles from URLs that users or outside parties can supply are exposed through the image extractor. Scripts that only parse trusted, fixed content are unlikely to be reachable. unknown for any further detail the sources do not give.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000688,"input_tokens":4254,"output_tokens":526,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120416':15A,18A '-2026':14A,17A '0.9.6':84C '0.9.6.1':119C 'advis':135C 'affect':86C,132C,155C 'allow':4A 'andyfactori':80C 'applic':59B 'articl':11A,34B,64B 'article.parse':89C 'attack':54B,114C 'compon':96C,133C 'contact':139C 'craft':42B 'cve':13A,16A 'detect':78C 'earli':140C 'eec5fab21897c14667c98f5ba1831ebd3a692dd4':129C 'extractor':3A,98C 'fetch':29B 'file':92C 'fix':151C 'forgeri':9A,107C 'found':32B 'function':88C 'get':57B 'host':52B 'imag':2A,30B,97C 'intern':51B 'issu':122C 'launch':112C 'lead':101C 'librari':27B 'make':45B 'malici':63B 'manipul':100C 'manner':146C 'mitig':120C 'name':124C 'newspaper/extractors/image_extractor.py':93C 'newspaper4k':1A,19B,28B,81C 'packag':20B 'page':43B 'pars':61B 'patch':127C 'point':39B 'possibl':110C 'product':156C 'profession':145C 'python':21B,26B 'quick':148C 'reach':66B 'releas':149C 'remot':115C 'request':8A,49B,106C 'respond':141C 'restrict':36B 'scrape':24B 'secur':74C 'see':72B 'send':48B 'server':6A,47B,69B,104C 'server-sid':5A,103C 'servic':67B 'side':7A,105C 'upgrad':116C,130C 'url':12A,31B 'vendor':137C 'version':118C,152C 'vulner':75C 'web':23B 'web-scrap':22B 'without':35B","nicknames":[],"mitigations":[],"who_affected":"Applications that use newspaper4k to download and parse articles from URLs that users or outside parties can supply are exposed through the image extractor. Scripts that only parse trusted, fixed content are unlikely to be reachable. unknown for any further detail the sources do not give.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","newspaper4k","package","python","webscraping"],"first_public_at":"2026-11-02T18:18:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120416","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120416","severity":null,"published_at":"2026-11-02T18:18:50+00:00","modified_at":"2026-11-02T18:18:50+00:00","first_seen_at":"2026-11-02T18:24:24+00:00","fetched_at":"2026-11-02T18:24:24+00:00","note":null}],"documents":[{"id":53251,"url":"https://github.com/AndyTheFactory/newspaper4k/commit/eec5fab21897c14667c98f5ba1831ebd3a692dd4","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":53252,"url":"https://github.com/AndyTheFactory/newspaper4k/releases/tag/0.9.6.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}