newspaper4k CVE-2026-120416

Exploitation requires the integrating application to invoke newspaper4k's Article download/parse on a URL or page whose content the attacker controls or can influence, with image extraction active. In versions ≤0.9.6 the Image Extractor's _fetch_image follows page-derived image URLs and meta-refresh redirects (up to the redirect chain) without validating the target against private/internal/link-local IP ranges, so an embedded URL pointing at 127.0.0.1, 169.254.169.254, [::1], or an internal hostname is fetched server-side. Limiting factors: the attacker cannot trigger this directly against the newspaper4k host - a victim application must process attacker-supplied content; impact is limited to confidentiality (VC:L, reading internal responses) with no integrity or availability effect; and the fix adds a Configuration.allow_private_hosts flag defaulting to False that blocks non-public URLs, so patched deployments are safe unless an operator explicitly re-enables private-host fetching.

The CVSS 4.0 base score of 6.9 (medium) reflects a network, low-complexity, no-privilege, no-user-interaction vector (AV:N/AC:L/AT:N/PR:N/UI:N) but with impact confined to limited confidentiality (VC:L) and no integrity or availability effect - consistent with a server-side request forgery that leaks internal responses rather than achieving code execution. The vuln.today decision label is 'this_month', not 'act_now' or 'emergency', signaling elevated but non-urgent priority. No EPSS score, no CISA KEV listing, and no verified exploit code were provided, so there is no evidence of active or widespread exploitation; this reads as a genuine but moderate-priority issue rather than a high-CVSS-but-low-real-risk false alarm or an urgent emergency. The practical risk is heavily conditioned on deployment: the 'unauthenticated/remote' framing is accurate only in the sense that the attacker supplies malicious page content - real exposure exists only where an integrating application invokes newspaper4k's download/parse on attacker-controlled or attacker-influenced URLs, and it is most dangerous in cloud environments where the SSRF can reach instance-metadata endpoints (e.g. 169.254.169.254), as the added regression tests explicitly target.

An attacker publishes a web page (or seeds an article URL) whose HTML embeds an image URL or meta-refresh pointing at an internal/cloud-metadata host such as http://169.254.169.254/latest/meta-data/ or http://127.0.0.1/. When a backend service using newspaper4k ≤0.9.6 downloads and parses that page, the Image Extractor fetches the page-derived URL (and follows redirects) with no validation against private IP ranges, causing the server to issue requests to internal resources. No public exploit was identified at time of analysis; the SSRF mechanism and the redirect-following path are confirmed by the vendor's patch diff and accompanying regression tests, and the AV:N/AC:L vector means the request requires no special timing or conditions once the page is processed.