Read the docs
TI-2026-83926 Aliases CVE-2026-120416GHSA-hv55-xhhq-h9rr

Server-side request forgery in newspaper4k image extractor

Priority LOW 36CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

AndyFactory newspaper4k versions 0.9.0 through 0.9.6 are affected. Manipulated input to the Article.parse function in the image extractor causes server-side request forgery (CWE-918). A remote attacker can trigger this without authentication or user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

A security vulnerability has been detected in AndyFactory newspaper4k up to 0.9.6. This affects the function Article.parse of the file newspaper/extractors/image_extractor.py of the component Image Extractor. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. Upgrading to version 0.9.6.1 mitigates this issue. The name of the patch is eec5fab21897c14667c98f5ba1831ebd3a692dd4. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00322 25th percentileScored 2026-11-07
Fix Fixed newspaper4k (AndyFactory): 0.9.6.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AndyFactorynewspaper4k0.9.0; 0.9.1; 0.9.2; 0.9.3; 0.9.4; 0.9.5; 0.9.60.9.6.1Patch availableCNA
  • newspaper4k VendorAndyFactory Affected 0.9.0; 0.9.1; 0.9.2; 0.9.3; 0.9.4; 0.9.5; 0.9.6 Fixed in 0.9.6.1 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:andyfactory:newspaper4k:*:*:*:*:*:*:*:*——AndyFactory
  • cpe:2.3:a:andyfactory:newspaper4k:*:*:*:*:*:*:*:* Versions — — ·AndyFactory

Remediation

Upgrade newspaper4k to version 0.9.6.1, which fixes the issue. The fix is patch eec5fab21897c14667c98f5ba1831ebd3a692dd4.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA newspaper4k (AndyFactory) Fixed in 0.9.6.1

Timeline

  1. 2026-11-02 Threatist record created from CVE-2026-120416
  2. 2026-11-02 Alias added: GHSA-hv55-xhhq-h9rr
  3. 2026-11-04 Priority changed: MEDIUM → LOW
  4. 2026-11-07 CISA SSVC decision points changed

References

Patch 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences