CVE-2026-105782 — Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware
Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Polic…
Published: 2026-10-05 · CVSS: 7.5 · CVSS 3.1
Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path as a referrer policy class, imported the referenced object, and called it. A malicious website could supply a callable such as sys.exit and terminate a crawler processing the response. This issue is fixed in version 2.14.2.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7