---
id: "CVE-2026-120416"
kind: "vulnerability"
aliases: ["CVE-2026-120416"]
title: "newspaper4k: image extractor allows server-side request forgery from article URLs"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["newspaper4k", "package", "python", "web-scraping"]
not_affected_if: ["no-user-supplied-urls", "pinned-to-fixed-version"]
published_at: "2026-11-02T18:18:50+00:00"
first_seen_at: "2026-11-02T18:24:24+00:00"
updated_at: "2026-11-02T18:24:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120416", "first_seen_at": "2026-11-02T18:24:24+00:00"}]
---

# newspaper4k: image extractor allows server-side request forgery from article URLs

The Python library newspaper4k fetches image URLs found in articles without restricting where they point, so a crafted page can make the server send requests to internal hosts. An attacker who can get the application to parse a malicious article can reach services the server itself can see.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `pip show newspaper4k` and compare it to the fixed release.
- Search the codebase for imports of `newspaper` or `newspaper4k` that call `Article.parse` on user-supplied URLs.

## Fix

- newspaper4k: upgrade to `0.9.6.1`

## Timeline

- 2026-11-02T18:24:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120416

## Documents

- [fix] Patch: github.com https://github.com/AndyTheFactory/newspaper4k/commit/eec5fab21897c14667c98f5ba1831ebd3a692dd4
- [fix] Release notes: github.com https://github.com/AndyTheFactory/newspaper4k/releases/tag/0.9.6.1

## From the sources

A security vulnerability has been detected in AndyFactory newspaper4k up to 0.9.6. This affects the function Article.parse of the file newspaper/extractors/image_extractor.py of the component Image Extractor. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. Upgrading to version 0.9.6.1 mitigates this issue. The name of the patch is eec5fab21897c14667c98f5ba1831ebd3a692dd4. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_