Security
فارسی
All products

scrapy

PyPI · Package
14 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddlewareCVE-2026-105782 · GHSA-CWXJ-RR6W-M6W7Version ranges need review. scrapy PyPI High Fix reported
Incorrect Authorization and Exposure of Sensitive Information to an Unauthorized Actor in scrapyCVE-2022-0577 · GHSA-CJVR-MFJ7-J4J8Version ranges need review. scrapy PyPI Medium Fix reported
Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by defaultCVE-2026-84366 · GHSA-76G3-C3X4-CRVXVersion ranges need review. scrapy PyPI High Fix reported
Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementationCVE-2025-6176 · GHSA-2QFP-Q593-8484Version ranges need review. brotliscrapy PyPIRed Hat High Fix reported
Scrapy HTTP authentication credentials potentially leaked to target websites CVE-2021-41125 · GHSA-JWQP-28GF-P498Version ranges need review. scrapy PyPI Medium Fix reported
Scrapy decompression bomb vulnerabilityCVE-2024-3572 · GHSA-7J7M-V7M3-JQM7Version ranges need review. scrapy PyPI High Fix reported
Scrapy authorization header leakage on cross-domain redirectCVE-2024-3574 · GHSA-CW9J-Q3VF-HRRVVersion ranges need review. scrapy PyPI High Fix reported
Scrapy vulnerable to ReDoS via XMLFeedSpiderCVE-2024-1892 · GHSA-CC65-XXVF-F7R9Version ranges need review. scrapy PyPI High Fix reported
Scrapy leaks the authorization header on same-domain but cross-origin redirectsCVE-2024-1968 · GHSA-4QQQ-9VQF-3H3FVersion ranges need review. scrapy PyPI Medium Fix reported
Scrapy denial of service vulnerabilityCVE-2017-14158 · GHSA-H7WM-PH43-C39PVersion ranges need review. scrapy PyPI High No fix reported
Scrapy cookie-setting is not restricted based on the public suffix listGHSA-MFJM-VH54-3F96 scrapy PyPI Medium Fix reported
Scrapy allows redirect following in protocols other than HTTPGHSA-23J4-MW76-5V7H scrapy PyPI Medium Fix reported
Scrapy before 2.6.2 and 1.8.3 vulnerable to one proxy sending credentials to anotherGHSA-9X8M-2XPF-CRP3 scrapy PyPI Medium Fix reported
Scrapy's redirects ignoring scheme-specific proxy settingsGHSA-JM3V-QXMH-HXWV scrapy PyPI Medium Fix reported