CVE-2026-120416

MEDIUM 5.3

AndyFactory newspaper4k Image Extractor image_extractor.py Article.parse server-side request forgery

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

A security vulnerability has been detected in AndyFactory newspaper4k up to 0.9.6. This affects the function Article.parse of the file newspaper/extractors/image_extractor.py of the component Image Extractor. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. Upgrading to version 0.9.6.1 mitigates this issue. The name of the patch is eec5fab21897c14667c98f5ba1831ebd3a692dd4. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CWE	CWE-918
Vendor	andyfactory
Product	newspaper4k
Published	Nov 2, 2026

Stay Ahead of the Next One

Get instant alerts for andyfactory newspaper4k

Be the first to know when new medium vulnerabilities affecting andyfactory newspaper4k are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

AndyFactory / newspaper4k

0.9.0 0.9.1 0.9.2 0.9.3 0.9.4 0.9.5 0.9.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/429801 vuldb.com: https://vuldb.com/vuln/429801/cti vuldb.com: https://vuldb.com/cve/CVE-2026-120416 vuldb.com: https://vuldb.com/submit/1026136 github.com: https://github.com/AndyTheFactory/newspaper4k/issues/741 pypi.org: https://pypi.org/project/newspaper4k/0.9.6.1/ github.com: https://github.com/AndyTheFactory/newspaper4k/commit/eec5fab21897c14667c98f5ba1831ebd3a692dd4 github.com: https://github.com/AndyTheFactory/newspaper4k/releases/tag/0.9.6.1

Credits

🔍 Mohammedix88 (VulDB User) VulDB CNA Team