CyberRota Analysis
AI-GeneratedThe vulnerability affects Scrapy versions 1.4.0 through 2.14.2, where the RefererMiddleware improperly processes Referrer-Policy headers, allowing a malicious website to execute arbitrary code, such as terminating the crawler. This poses a significant risk to web scraping applications that utilize Scrapy, as it can lead to denial of service. Developers and organizations using Scrapy for web crawling and scraping should prioritize updating to version 2.14.2 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path as a referrer policy class, imported the referenced object, and called it. A malicious website could supply a callable such as sys.exit and terminate a crawler processing the response. This issue is fixed in version 2.14.2.