Unsafe Reflection Affecting scrapy package, versions [1.4.0,2.14.2)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-SCRAPY-15624315
- published15 Mar 2026
- disclosed13 Mar 2026
- creditTomer Fichman
Introduced: 13 Mar 2026
New CVE NOT AVAILABLE CWE-470 (opens in a new tab)How to fix?
Upgrade Scrapy to version 2.14.2 or higher.
Overview
Scrapy is a high-level web crawling and web scraping framework, used to crawl websites and extract structured data from their pages.
Affected versions of this package are vulnerable to Unsafe Reflection via the Referrer-Policy header handled by RefererMiddleware(). An attacker can execute commands by supplying a malicious import path such as sys.exit in the response header which is read by the vulnerable application.
Workaround
This vulnerability can be avoided by disabling the middleware, setting the REFERER_ENABLED setting to False, manually setting the Referer header, or setting the referrer_policy meta key on all requests.