CVE-2026-105782: Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware
Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path as a referrer policy class, imported the referenced object, and called it. A malicious website could supply a callable such as sys.exit and terminate a crawler processing the response. This issue is fixed in version 2.14.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Scrapyto a version that resolves this vulnerability.Fixed in 2.14.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Scrapy installations from 1.4.0 through versions before 2.14.2 are affected if their crawlers process responses from malicious websites.
What must an attacker do to trigger the issue?
An attacker needs to operate or control a website that the crawler processes and return a crafted Referrer-Policy response header. No authentication or user interaction is required.
What is the practical impact of successful exploitation?
The reported impact is loss of availability. A malicious response can cause the crawler process to terminate, for example by causing sys.exit to be imported and called.
How can I determine whether an installation needs remediation?
Check the installed Scrapy version. Versions from 1.4.0 up to, but not including, 2.14.2 require remediation.
What version fixes the issue?
Upgrade Scrapy to version 2.14.2, which includes the fix.