CVE-2026-105782: Scrapy

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path as a referrer policy class, imported the referenced object, and called it. A malicious website could supply a callable such as sys.exit and terminate a crawler processing the response. This issue is fixed in version 2.14.2.

Affected products

• Scrapy Scrapy: from 1.4.0, before 2.14.2 (fixed in 2.14.2)

Published 2026-10-06. Last modified 2026-10-06.