The vulnerability exists in the Image Extractor component, specifically the Article.parse function within image_extractor.py, and allows an attacker to trigger outbound HTTP requests from the server. This server‑side request forgery (SSRF) can enable the attacker to reach internal network resources, read sensitive data, or discover internal services, thereby compromising confidentiality and potentially integrity. The flaw can be triggered remotely by supplying crafted input, giving the adversary a clear attack vector.

AndyFactory’s newspaper4k library is impacted in all releases up to and including version 0.9.6. Upgrading to 0.9.6.1 (or later) applies the patch identified by commit eec5fab21897c14667c98f5ba1831ebd3a692dd4 and removes the vulnerability.

The CVSS score of 6.9 indicates a moderate to high severity, the EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The attack can be carried out remotely and does not require prior authentication, making it accessible to attackers with internet exposure to the server. Given the lack of publicly disclosed exploits, the likelihood of immediate exploitation remains uncertain, but the potential impact warrants prompt remediation.