CVE-2026-105782
scrapy
Published 6 Oct 2026 · updated 6 Oct 2026 · Awaiting Analysis
7.5 High · CVSS 3.1, github.com
Description
Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path as a referrer policy class, imported the referenced object, and called it. A malicious website could supply a callable such as sys.exit and terminate a crawler processing the response. This issue is fixed in version 2.14.2.