https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 15:18:26 +0000 https://vulnerability.circl.lu/vuln/brew-scrapy-ghsa-cwxj-rr6w-m6w7 <p><strong>Affected:</strong> Homebrew: scrapy</p> <p>### Impact</p> <p>Since version 1.4.0, Scrapy respects the `Referrer-Policy` response header to decide whether and how to set a `Referer` header on follow-up requests.</p> <p>If the header value looked like a valid Python import path, Scrapy would import the referenced object and call it, assuming it referred to a referrer policy class (for example, `scrapy.spidermiddlewares.referer.DefaultReferrerPolicy`) and attempting to instantiate it to handle the `Referer` header.</p> <p>A malicious site could exploit this by setting `Referrer-Policy` to a path such as `sys.exit`, causing Scrapy to import and execute it and potentially terminate the process.</p> <p>### Patches</p> <p>Upgrade to Scrapy 2.14.2 (or later).</p> <p>### Workarounds</p> <p>If you cannot upgrade to Scrapy 2.14.2, consider the following mitigations.</p> <p>- **Disable the middleware:** If you don&#39;t need the `Referer` header on follow-up requests, set [`REFERER_ENABLED`](https://docs.scrapy.org/en/latest/topics/spider-middleware.html#referer-enabled) to `False`. - **Set headers manually:** If you do need a `Referer`, disable the middleware and set the header explicitly on the requests that require it. - **Set `referrer_policy` in request metadata:** If disabling the middleware is not viable, set the [`referrer_policy`](https://docs.scrapy.org/en/latest/topics/spider-middleware.html#referrer-policy) request meta key on all requests to prevent evaluating preceding responses&#39; `Referrer-Policy`. For example:</p> <p>```python Request( url, meta={ &#34;referr…</p> <p><strong>Affected:</strong> Homebrew: scrapy</p> <p>### Impact</p> <p>Since version 1.4.0, Scrapy respects the `Referrer-Policy` response header to decide whether and how to set a `Referer` header on follow-up requests.</p> <p>If the header value looked like a valid Python import path, Scrapy would import the referenced object and call it, assuming it referred to a referrer policy class (for example, `scrapy.spidermiddlewares.referer.DefaultReferrerPolicy`) and attempting to instantiate it to handle the `Referer` header.</p> <p>A malicious site could exploit this by setting `Referrer-Policy` to a path such as `sys.exit`, causing Scrapy to import and execute it and potentially terminate the process.</p> <p>### Patches</p> <p>Upgrade to Scrapy 2.14.2 (or later).</p> <p>### Workarounds</p> <p>If you cannot upgrade to Scrapy 2.14.2, consider the following mitigations.</p> <p>- **Disable the middleware:** If you don&#39;t need the `Referer` header on follow-up requests, set [`REFERER_ENABLED`](https://docs.scrapy.org/en/latest/topics/spider-middleware.html#referer-enabled) to `False`. - **Set headers manually:** If you do need a `Referer`, disable the middleware and set the header explicitly on the requests that require it. - **Set `referrer_policy` in request metadata:** If disabling the middleware is not viable, set the [`referrer_policy`](https://docs.scrapy.org/en/latest/topics/spider-middleware.html#referrer-policy) request meta key on all requests to prevent evaluating preceding responses&#39; `Referrer-Policy`. For example:</p> <p>```python Request( url, meta={ &#34;referr…</p> https://vulnerability.circl.lu/vuln/brew-scrapy-ghsa-cwxj-rr6w-m6w7 https://vulnerability.circl.lu/vuln/cve-2026-105782 <p><strong>Affected:</strong> scrapy</p> <p>Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path as a referrer policy class, imported the referenced object, and called it. A malicious website could supply a callable such as sys.exit and terminate a crawler processing the response. This issue is fixed in version 2.14.2.</p> <p><strong>Affected:</strong> scrapy</p> <p>Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path as a referrer policy class, imported the referenced object, and called it. A malicious website could supply a callable such as sys.exit and terminate a crawler processing the response. This issue is fixed in version 2.14.2.</p> https://vulnerability.circl.lu/vuln/cve-2026-105782