Description
Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path as a referrer policy class, imported the referenced object, and called it. A malicious website could supply a callable such as sys.exit and terminate a crawler processing the response. This issue is fixed in version 2.14.2.
Published: 2026-10-05
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote code execution via improper header processing
Action: Immediate Patch
AI Analysis

Impact

Scrapy's RefererMiddleware incorrectly treated the Referrer-Policy header as an import path, loading and executing the referenced Python object. A malicious site could send a Referrer-Policy header pointing to a callable such as sys.exit, causing the crawler to invoke arbitrary code or terminate. This vulnerability can lead to denial of service or the execution of arbitrary commands within the crawler process, classified as arbitrary code execution (CWE‑470).

Affected Systems

The issue affects Scrapy versions from 1.4.0 through 2.14.2 inclusive. All users running these releases on any platform are vulnerable until they upgrade beyond 2.14.2.

Risk and Exploitability

The CVSS base score of 7.5 indicates a high severity. Because the vulnerability depends on a remote website that sends a crafted Referrer-Policy header, the attack vector is remote and requires the crawler to fetch that site. The exploitation condition is low: anyone who can host a site served to the crawler can trigger the flaw. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV, but the high CVSS and the ability to inject arbitrary code make it a significant risk for environments that crawl untrusted domains.

Generated by OpenCVE AI on October 6, 2026 at 00:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official patch by upgrading to Scrapy 2.14.2 or later.
  • If immediate upgrade cannot be made, temporarily disable RefererMiddleware in the crawler's settings to prevent processing of Referrer-Policy headers.
  • Configure the crawler to restrict HTTP requests to trusted domains or enforce a whitelist to avoid contacting sites that could supply malicious Referrer-Policy headers.

Generated by OpenCVE AI on October 6, 2026 at 00:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-cwxj-rr6w-m6w7 Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware
History

Tue, 06 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Tue, 06 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Scrapy
Scrapy scrapy
Vendors & Products Scrapy
Scrapy scrapy

Mon, 05 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Description Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path as a referrer policy class, imported the referenced object, and called it. A malicious website could supply a callable such as sys.exit and terminate a crawler processing the response. This issue is fixed in version 2.14.2.
Title Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware
Weaknesses CWE-470
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Scrapy Scrapy
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-06T13:44:10.445Z

Reserved: 2026-10-05T20:37:19.362Z

Link: CVE-2026-105782

cve-icon Vulnrichment

Updated: 2026-10-06T13:42:58.859Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-06T00:16:33.613

Modified: 2026-10-06T16:00:36.547

Link: CVE-2026-105782

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-05T23:08:55Z

Links: CVE-2026-105782 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-06T00:30:18Z

Weaknesses
  • CWE-470

    Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')