جزئیات آسیب‌پذیری
CVE-2026-120416
AndyFactory newspaper4k Image Extractor image_extractor.py Article.parse server-side request forgery
خلاصه‌ی فارسی
خلاصه‌ی فارسی برای این آسیب‌پذیری هنوز تهیه نشده است.
شرح رسمی (انگلیسی)
A security vulnerability has been detected in AndyFactory newspaper4k up to 0.9.6. This affects the function Article.parse of the file newspaper/extractors/image_extractor.py of the component Image Extractor. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. Upgrading to version 0.9.6.1 mitigates this issue. The name of the patch is eec5fab21897c14667c98f5ba1831ebd3a692dd4. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 6.9متوسط | 4.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X |
| 5.3متوسط | 3.1 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C |
| 5.3متوسط | 3.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C |
| 5.0متوسط | 2.0 | CVEProject cvelistV5 (CNA) (VulDB) | AV:N/AC:L/Au:N/C:P/I:N/A:N/E:ND/RL:OF/RC:C |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| AndyFactory | newspaper4k | 0.9.0 | CVEProject cvelistV5 (CNA) |
| AndyFactory | newspaper4k | 0.9.1 | CVEProject cvelistV5 (CNA) |
| AndyFactory | newspaper4k | 0.9.2 | CVEProject cvelistV5 (CNA) |
| AndyFactory | newspaper4k | 0.9.3 | CVEProject cvelistV5 (CNA) |
| AndyFactory | newspaper4k | 0.9.4 | CVEProject cvelistV5 (CNA) |
| AndyFactory | newspaper4k | 0.9.5 | CVEProject cvelistV5 (CNA) |
| AndyFactory | newspaper4k | 0.9.6 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۸- https://vuldb.com/vuln/429801 vdb-entrytechnical-description
- https://vuldb.com/vuln/429801/cti signaturepermissions-required
- https://vuldb.com/cve/CVE-2026-120416 third-party-advisory
- https://vuldb.com/submit/1026136 third-party-advisory
- https://github.com/AndyTheFactory/newspaper4k/issues/741 issue-tracking
- https://pypi.org/project/newspaper4k/0.9.6.1/ related
- https://github.com/AndyTheFactory/newspaper4k/commit/eec5fab21897c14667c98f5ba1831ebd3a692dd4 patch
- https://github.com/AndyTheFactory/newspaper4k/releases/tag/0.9.6.1 patch
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۸/۱۱
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۸/۱۱
- وضعیت
- PUBLISHED
- صادرکننده (CNA)
- VulDB
- اولویت کلون
- به‌زودی
پیش‌بینی بهره‌برداری (EPSS)
ضعف‌ها (CWE)
- CWE-918Server-Side Request Forgery