The S3DownloadHandler in Scrapy converts requests to the S3 scheme into plaintext HTTP when an explicit secure flag is not set, leading to the transmission of sensitive information such as bucket names, keys, AWS Authorization headers, and temporary security tokens over an unencrypted channel. This establishes a wide window for attackers to eavesdrop on the request data and subsequently retrieve the requested object contents and response headers. In addition, an active man‑in‑the‑middle attacker can modify the plaintext response body, status code, and headers before Scrapy processes them, enabling data poisoning of the scraped output, corrupting exports, poisoning caches, or steering the crawler through forged redirects or malicious links. The flaw is associated with the weakness CWE-319: Cleartext Transmission of Sensitive Information.

Users of the Scrapy framework, specifically those employing S3-scheme requests with AWS credentials, are impacted when running a version prior to 2.17.0. The issue is fixed in Scrapy 2.17.0 and later releases.

With a CVSS score of 7.4, the vulnerability is classified as high severity. Although EPSS data is not available, the absence from the CISA KEV list does not diminish the potential for exploitation; a network attacker who can observe traffic between the crawler and S3 is positioned to acquire confidential credentials and response data. The likelihood is increased in environments where Scrapy is the sole software interacting with S3, making the risk of interception or tampering substantial under typical network conditions.