CVE-2026-105782

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-105782", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-05T20:37:19.362Z", "datePublished": "2026-10-05T23:08:55.749Z", "dateUpdated": "2026-10-06T13:44:10.445Z"}, "containers": {"cna": {"title": "Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware", "problemTypes": [{"descriptions": [{"cweId": "CWE-470", "lang": "en", "description": "CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/scrapy/scrapy/security/advisories/GHSA-cwxj-rr6w-m6w7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/scrapy/scrapy/security/advisories/GHSA-cwxj-rr6w-m6w7"}, {"name": "https://github.com/scrapy/scrapy/commit/945b787a263586cb5803c01c6da57daad8997ae5", "tags": ["x_refsource_MISC"], "url": "https://github.com/scrapy/scrapy/commit/945b787a263586cb5803c01c6da57daad8997ae5"}, {"name": "https://github.com/scrapy/scrapy/commit/b6e5c58ae707a3d4bb491537b5519534050047e0", "tags": ["x_refsource_MISC"], "url": "https://github.com/scrapy/scrapy/commit/b6e5c58ae707a3d4bb491537b5519534050047e0"}, {"name": "https://github.com/scrapy/scrapy/releases/tag/2.14.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/scrapy/scrapy/releases/tag/2.14.2"}], "affected": [{"vendor": "scrapy", "product": "scrapy", "versions": [{"version": ">= 1.4.0, < 2.14.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-05T23:08:55.749Z"}, "descriptions": [{"lang": "en", "value": "Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path as a referrer policy class, imported the referenced object, and called it. A malicious website could supply a callable such as sys.exit and terminate a crawler processing the response. This issue is fixed in version 2.14.2."}], "source": {"advisory": "GHSA-cwxj-rr6w-m6w7", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-06T13:40:40.903121Z", "id": "CVE-2026-105782", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T13:44:10.445Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware", "source": {"advisory": "GHSA-cwxj-rr6w-m6w7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "scrapy", "product": "scrapy", "versions": [{"status": "affected", "version": ">= 1.4.0, < 2.14.2"}]}], "references": [{"url": "https://github.com/scrapy/scrapy/security/advisories/GHSA-cwxj-rr6w-m6w7", "name": "https://github.com/scrapy/scrapy/security/advisories/GHSA-cwxj-rr6w-m6w7", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/scrapy/scrapy/commit/945b787a263586cb5803c01c6da57daad8997ae5", "name": "https://github.com/scrapy/scrapy/commit/945b787a263586cb5803c01c6da57daad8997ae5", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/scrapy/scrapy/commit/b6e5c58ae707a3d4bb491537b5519534050047e0", "name": "https://github.com/scrapy/scrapy/commit/b6e5c58ae707a3d4bb491537b5519534050047e0", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/scrapy/scrapy/releases/tag/2.14.2", "name": "https://github.com/scrapy/scrapy/releases/tag/2.14.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path as a referrer policy class, imported the referenced object, and called it. A malicious website could supply a callable such as sys.exit and terminate a crawler processing the response. This issue is fixed in version 2.14.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-470", "description": "CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-05T23:08:55.749Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-105782", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-06T13:40:40.903121Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-10-06T13:42:58.859Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-105782", "state": "PUBLISHED", "dateUpdated": "2026-10-05T23:08:55.749Z", "dateReserved": "2026-10-05T20:37:19.362Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-05T23:08:55.749Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "scrapy", "vendor": "scrapy", "versions": [{"status": "affected", "version": ">= 1.4.0, < 2.14.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path as a referrer policy class, imported the referenced object, and called it. A malicious website could supply a callable such as sys.exit and terminate a crawler processing the response. This issue is fixed in version 2.14.2."}], "id": "CVE-2026-105782", "lastModified": "2026-10-06T16:00:36.547", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-105782", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-06T13:40:40.903121Z", "version": "2.0.3"}}]}, "published": "2026-10-06T00:16:33.613", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/scrapy/scrapy/commit/945b787a263586cb5803c01c6da57daad8997ae5"}, {"source": "security-advisories@github.com", "url": "https://github.com/scrapy/scrapy/commit/b6e5c58ae707a3d4bb491537b5519534050047e0"}, {"source": "security-advisories@github.com", "url": "https://github.com/scrapy/scrapy/releases/tag/2.14.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/scrapy/scrapy/security/advisories/GHSA-cwxj-rr6w-m6w7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-470"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "scrapy: Scrapy: Denial of Service via crafted Referrer-Policy header", "id": "2546224", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546224"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-470", "details": ["A flaw was found in Scrapy. A remote attacker controlling a malicious website can cause a Denial of Service (DoS) by providing a specially crafted Referrer-Policy HTTP response header. When processing the response, the RefererMiddleware treats the header value as a Python import path and executes the referenced object, enabling the attacker to terminate the crawling process."], "name": "CVE-2026-105782", "public_date": "2026-10-05T23:08:55Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-105782\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105782\nhttps://github.com/scrapy/scrapy/commit/945b787a263586cb5803c01c6da57daad8997ae5\nhttps://github.com/scrapy/scrapy/commit/b6e5c58ae707a3d4bb491537b5519534050047e0\nhttps://github.com/scrapy/scrapy/releases/tag/2.14.2\nhttps://github.com/scrapy/scrapy/security/advisories/GHSA-cwxj-rr6w-m6w7"], "statement": "Red Hat Product Security has rated this vulnerability as Important because an untrusted remote web server can trigger an unauthenticated denial of service against crawling processes. When a spider ingests an HTTP response with a crafted header, the framework resolves and executes arbitrary module paths, causing immediate termination of the scraping job. In typical deployments, this risk specifically impacts crawlers processing external or untrusted web destinations. Spiders scraping only internal, authenticated, or trusted sources are not exposed.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.4.0,2.14.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "scrapy", "source": "cna", "vendor": "scrapy"}, "product": "scrapy", "vendor": "scrapy"}], "created": "2026-10-06T00:30:18.126939+00:00", "updated": "2026-10-06T00:30:18.712461+00:00", "vendors": ["scrapy", "scrapy$PRODUCT$scrapy"]}