| Title | AndyTheFactory newspaper4k 0.9.6 Server-Side Request Forgery |
|---|
| Description | newspaper4k up to 0.9.6 is affected by a server-side request forgery vulnerability in the article image extraction path. When Article.parse() is called, image fetching is enabled by default (fetch_images=True). The image extractor collects image URLs directly from the parsed article content, including <img> src attributes and the og:image meta tag, and then fetches them server-side in ImageExtractor (newspaper/extractors/image_extractor.py, around line 197). The only validation performed is a URL scheme check, so there is no restriction on the destination host. An attacker who controls or influences the HTML of a page that the application parses can embed an image URL that points at an internal address and cause the server to issue a request to it. This enables reaching internal-only services, cloud metadata endpoints, and other hosts not reachable by the attacker directly. Runtime verified against the latest release by parsing a crafted article and capturing an outbound request to an internal 127.0.0.1 listener. Affected: up to 0.9.6. CWE-918. CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5. |
|---|
| Source | ⚠️ https://github.com/AndyTheFactory/newspaper4k/issues/741 |
|---|
| User | Anonymous User |
|---|
| Submission | 10/12/2026 20:06 (21 days ago) |
|---|
| Moderation | 11/02/2026 12:58 (21 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 429801 [AndyFactory newspaper4k up to 0.9.6 Image Extractor image_extractor.py Article.parse server-side request forgery] |
|---|
| Points | 20 |
|---|