CVE-2026-105782

Published: Oct 6, 2026Modified: Oct 6, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path as a referrer policy class, imported the referenced object, and called it. A malicious website could supply a callable such as sys.exit and terminate a crawler processing the response. This issue is fixed in version 2.14.2.

Related CWEs

CWE-470

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

References (4)

https://github.com/scrapy/scrapy/commit/945b787a263586cb5803c01c6da57daad8997ae5

Source: security-advisories@github.com

https://github.com/scrapy/scrapy/commit/b6e5c58ae707a3d4bb491537b5519534050047e0

Source: security-advisories@github.com

https://github.com/scrapy/scrapy/releases/tag/2.14.2

Source: security-advisories@github.com

https://github.com/scrapy/scrapy/security/advisories/GHSA-cwxj-rr6w-m6w7

Source: security-advisories@github.com

Timeline

No history available yet.