{"id":"CVE-2026-105782","published":"2026-10-06T00:16:33.613","lastModified":"2026-10-06T16:00:36.547","description":"Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path as a referrer policy class, imported the referenced object, and called it. A malicious website could supply a callable such as sys.exit and terminate a crawler processing the response. This issue is fixed in version 2.14.2.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-470"],"vendors":[],"products":[],"references":[{"url":"https://github.com/scrapy/scrapy/commit/945b787a263586cb5803c01c6da57daad8997ae5","tags":[]},{"url":"https://github.com/scrapy/scrapy/commit/b6e5c58ae707a3d4bb491537b5519534050047e0","tags":[]},{"url":"https://github.com/scrapy/scrapy/releases/tag/2.14.2","tags":[]},{"url":"https://github.com/scrapy/scrapy/security/advisories/GHSA-cwxj-rr6w-m6w7","tags":[]}],"exploitRefs":[{"url":"https://github.com/scrapy/scrapy/commit/945b787a263586cb5803c01c6da57daad8997ae5","tags":[]},{"url":"https://github.com/scrapy/scrapy/commit/b6e5c58ae707a3d4bb491537b5519534050047e0","tags":[]},{"url":"https://github.com/scrapy/scrapy/releases/tag/2.14.2","tags":[]},{"url":"https://github.com/scrapy/scrapy/security/advisories/GHSA-cwxj-rr6w-m6w7","tags":[]}],"hasPoc":true,"ai":{"summary":"Scrapy's RefererMiddleware incorrectly interpreted Referrer-Policy header values as Python import paths and attempted to import and execute them as referrer policy classes. This allowed remote attackers to inject arbitrary Python code that could terminate crawlers by calling functions like sys.exit.","exploitability":"Exploitation requires a malicious website to serve a response with a specially crafted Referrer-Policy header, making it moderately difficult to exploit without direct control over a web server but possible through phishing or compromised sites.","blast_radius":"The impact is limited to crawler processes that encounter the malicious response, potentially causing crawlers to terminate unexpectedly and halting data collection workflows, but does not directly affect end-user applications or systems.","remediation":"Upgrade to Scrapy version 2.14.2 or later to fix the referer middleware vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web","crawler","python"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:02:50.222Z"}}