CVE-2024-3572: Scrapy

High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days.

The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This vulnerability allows attackers to perform denial of service attacks, access local files, generate network connections, or circumvent firewalls by submitting specially crafted XML data.

Affected products

• Scrapy Scrapy: before 2.11.1 (fixed in 2.11.1)

Published 2024-04-16. Last modified 2026-06-17.