CVE-2026-105782 | BDVDB-2026-383049 Detail

Description#

Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path as a referrer policy class, imported the referenced object, and called it. A malicious website could supply a callable such as sys.exit and terminate a crawler processing the response. This issue is fixed in version 2.14.2.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-05Record published in the CVE List.
2. Version 22026-10-06Most recent update recorded in the CVE List.