Homepage
About Snyk

scrapy@1.8.4 vulnerabilities

A high-level Web Crawling and Web Scraping framework

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the scrapy package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Information Exposure Through Sent Data

Scrapy is a high-level web crawling and web scraping framework, used to crawl websites and extract structured data from their pages.

Affected versions of this package are vulnerable to Information Exposure Through Sent Data due to the failure to remove the Authorization header when redirecting across domains. An attacker can potentially allow for account hijacking by exploiting the exposure of the Authorization header to unauthorized actors.

How to fix Information Exposure Through Sent Data?

Upgrade Scrapy to version 2.11.1 or higher.

[,2.11.1)
  • H
Regular Expression Denial of Service (ReDoS)

Scrapy is a high-level web crawling and web scraping framework, used to crawl websites and extract structured data from their pages.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when parsing content. An attacker can cause extreme CPU and memory usage by handling a malicious response.

How to fix Regular Expression Denial of Service (ReDoS)?

Upgrade Scrapy to version 2.11.1 or higher.

[,2.11.1)
  • M
Information Exposure

Scrapy is a high-level web crawling and web scraping framework, used to crawl websites and extract structured data from their pages.

Affected versions of this package are vulnerable to Information Exposure in which a spider could leak cookie headers when being forwarded to a third party, potentially attacker-controlled website.

How to fix Information Exposure?

Upgrade Scrapy to version 2.6.0 or higher.

[,2.6.0)
  • M
Denial of Service (DoS)

via S3FilesStore. Files are stored in memory before uploaded to s3, increasing memory usage if giant or many files are being uploaded at the same time.

[0,)
Go back to all versions of this package