Fluid Attacks Database

Description

Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path as a referrer policy class, imported the referenced object, and called it. A malicious website could supply a callable such as sys.exit and terminate a crawler processing the response. This issue is fixed in version 2.14.2.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	python-scrapy	=2.10.0-1 \|\| =2.11.0-1 \|\| =2.11.0-2 \|\| =2.11.1-1 \|\| =2.11.1-2 \|\| =2.11.2-1 \|\| =2.11.2-2 \|\| =2.11.2-3 \|\| =2.12.0-1 \|\| =2.12.0-2 \|\| =2.13.1-1~exp1 \|\| =2.13.3-1 \|\| =2.13.3-1~exp1 \|\| =2.13.4-1 \|\| =2.13.4-2 \|\| =2.14.0-1 \|\| =2.14.1-1 \|\| =2.14.2-1 \|\| =2.15.1-1 \|\| =2.16.0-1 \|\| =2.16.0-2 \|\| =2.17.0-1 \|\| =2.18.0-1 \|\| =2.18.0-2 \|\| =2.19.0-1 \|\| =2.8.0-2 \|\| =2.9.0-1 \|\| =2.9.0-1~exp1 \|\| =2.9.0-2	-
debian 14	python-scrapy	=2.12.0-2 \|\| =2.13.1-1~exp1 \|\| =2.13.3-1 \|\| =2.13.3-1~exp1 \|\| =2.13.4-1 \|\| =2.13.4-2 \|\| =2.14.0-1 \|\| =2.14.1-1 \|\| >=0 <2.14.2-1	2.14.2-1
debian 13	python-scrapy	=2.12.0-2 \|\| =2.13.1-1~exp1 \|\| =2.13.3-1 \|\| =2.13.3-1~exp1 \|\| =2.13.4-1 \|\| =2.13.4-2 \|\| =2.14.0-1 \|\| =2.14.1-1 \|\| =2.14.2-1 \|\| =2.15.1-1 \|\| =2.16.0-1 \|\| =2.16.0-2 \|\| =2.17.0-1 \|\| =2.18.0-1 \|\| =2.18.0-2 \|\| =2.19.0-1	-
pypi	scrapy	>=1.4.0 <2.14.2	2.14.2

Aliases

1. CVE-2026-1057822. NVD-2026-1057823. OSV-DEBIAN-2026-1057824. OSV-2026-1057825. GHSA-cwxj-rr6w-m6w76. GCVE-2026-1057827. SECURITY-TRACKER-CVE-2026-105782

References

1. https://github.com/scrapy/scrapy/security/advisories/GHSA-cwxj-rr6w-m6w72. https://github.com/scrapy/scrapy/commit/945b787a263586cb5803c01c6da57daad8997ae5

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.