Description
Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path as a referrer policy class, imported the referenced object, and called it. A malicious website could supply a callable such as sys.exit and terminate a crawler processing the response. This issue is fixed in version 2.14.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| scrapy | scrapy | >= 1.4.0, < 2.14.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-scrapy | 2.14.2-1 | — |
| Debian 13 | python-scrapy | No fix yet | — |
| Debian 12 | python-scrapy | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | python-scrapy | No fix yet | — |
| Ubuntu 16.04 LTS | python-scrapy | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | python-scrapy | No fix yet | — |
| Ubuntu Pro 22.04 LTS | python-scrapy | No fix yet | — |
| Ubuntu Pro 20.04 LTS | python-scrapy | No fix yet | — |
| Ubuntu Pro 18.04 LTS | python-scrapy | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | scrapy | >= 1.4.0, < 2.14.2 | 2.14.2 | GHSA-cwxj-rr6w-m6w7 |