CVE-2026-120416 Details
Description
A security vulnerability has been detected in AndyFactory newspaper4k up to 0.9.6. This affects the function Article.parse of the file newspaper/extractors/image_extractor.py of the component Image Extractor. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. Upgrading to version 0.9.6.1 mitigates this issue. The name of the patch is eec5fab21897c14667c98f5ba1831ebd3a692dd4. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
A server-side request forgery (SSRF) vulnerability has been identified in AndyFactory Newspaper4k versions through 0.9.6. The issue arises in the Image Extractor component, specifically within the Article.parse function of the image_extractor.py file. The vulnerability allows remote attackers to manipulate the application into making internal network requests, potentially accessing sensitive data or services.
Users are advised to upgrade to Newspaper4k version 0.9.6.1, which includes a patch for this vulnerability. The updated version can be installed via pip.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 2, 2026CISA-ADP
Assessed Nov 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/AndyTheFactory/newspaper4k/commit/eec5fab21897c14667c98f5ba1831ebd3a692dd4 | [email protected] | Source CodeVendor |
| https://github.com/AndyTheFactory/newspaper4k/issues/741 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/AndyTheFactory/newspaper4k/releases/tag/0.9.6.1 | [email protected] | Release NotesVendor |
| https://pypi.org/project/newspaper4k/0.9.6.1/ | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-120416 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1026136 | [email protected] | Permission Required |
| https://vuldb.com/vuln/429801 | [email protected] | Permission Required |
| https://vuldb.com/vuln/429801/cti | [email protected] | AdvisoryContent Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| AndyFactory newspaper4k | <= 0.9.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 7, 2026 | CVE Modified | CISA-ADP |
| Nov 2, 2026 | New CVE Received | [email protected] |