CVE-2026-120416— AndyFactory newspaper4k Image Extractor image_extractor.py Article.parse server-side request forgery

Quick assessment

Affected

AndyFactory newspaper4k

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 AndyFactory 的 newspaper4k 软件（版本 0.9.6 及更早版本）中发现了一个安全漏洞。该漏洞影响组件 Image Extractor 中文件 newspaper/extractors/image_extractor.py 的 Article.parse 函数。攻击者可通过操纵该函数引发服务器端请求伪造（SSRF），且攻击可远程发起。升级至版本 0.9.6.1 可缓解此问题。相关修复补丁的提交哈希为 eec5fab21897c14667c98f5ba1831ebd3a692dd4。建议尽快

CVSS 5.3 · Medium Updated Nov 03, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 8

Vendor	Product	Version Range	Status
AndyFactory	newspaper4k	`0.9.0`	affected
		`0.9.1`	affected
		`0.9.2`	affected
		`0.9.3`	affected
		`0.9.4`	affected
		`0.9.5`	affected
		`0.9.6`	affected
		`0.9.6.1`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

AndyFactory newspaper4k Image Extractor image_extractor.py Article.parse server-side request forgery

Source: CVE Program / CVE List V5

Vulnerability Description

A security vulnerability has been detected in AndyFactory newspaper4k up to 0.9.6. This affects the function Article.parse of the file newspaper/extractors/image_extractor.py of the component Image Extractor. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. Upgrading to version 0.9.6.1 mitigates this issue. The name of the patch is eec5fab21897c14667c98f5ba1831ebd3a692dd4. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

服务端请求伪造(SSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
AndyFactory	newspaper4k	0.9.0	`cpe:2.3:a:andyfactory:newspaper4k::::::::`

II. Public POCs for CVE-2026-120416

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120416

请登录查看更多情报信息。

Other References for CVE-2026-120416 (1)

CVE-2026-120416 | AndyFactory newspaper4k up to 0.9.6 Image Extractor image_extractor.py Article.parse server-side request forgery (Issue 741) vdb-entry technical-description

Other References for CVE-2026-120416 (7)

https://github.com/AndyTheFactory/newspaper4k/releases/tag/0.9.6.1 patch
https://pypi.org/project/newspaper4k/0.9.6.1/ related
https://github.com/AndyTheFactory/newspaper4k/commit/eec5fab21897c14667c98f5ba1831ebd3a692dd4 patch
https://github.com/AndyTheFactory/newspaper4k/issues/741 issue-tracking
https://vuldb.com/cve/CVE-2026-120416 third-party-advisory
https://vuldb.com/vuln/429801/cti signature permissions-required
https://vuldb.com/submit/1026136 third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120416

IV. Related Vulnerabilities

Same weakness: CWE-918