CVE-2026-105782 scrapy CVE debrief

Who should care

Defenders managing Scrapy-based applications should assess exposure and prioritize upgrading to Scrapy 2.14.2 or later to prevent potential process termination via Referrer-Policy header exploitation. This includes verifying Scrapy version and RefererMiddleware usage, and considering alternative mitigations if upgrading is not feasible. Security teams should review compensating controls and monitor for potential exploitation attempts.

Why it matters

CVE-2026-105782 allows malicious sites to potentially terminate Scrapy processes. Defenders should prioritize upgrading to Scrapy 2.14.2 or later.

• Potential process termination via malicious Referrer-Policy header
• Required verification of Scrapy version and RefererMiddleware usage
• Need for upgraded or mitigated Scrapy deployments

Technical summary

The Scrapy library respects the Referrer-Policy response header to decide whether and how to set a Referer header on follow-up requests. If the header value looks like a valid Python import path, Scrapy imports the referenced object and calls it, potentially allowing a malicious site to terminate the process. This vulnerability affects Scrapy versions 1.4.0 to 2.14.1 and can be mitigated by upgrading to Scrapy 2.14.2 or later. Defenders should assess exposure and prioritize upgrading to prevent potential process termination via Referrer-Policy header exploitation.

Defensive priority

Defenders should prioritize upgrading to Scrapy 2.14.2 or later to prevent potential process termination via Referrer-Policy header exploitation.

Recommended defensive actions

• Upgrade to Scrapy 2.14.2 or later
• Disable the RefererMiddleware if not needed
• Set Referer headers manually if required
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists in Scrapy versions 1.4.0 to 2.14.1. A malicious site can set the Referrer-Policy header to a path like sys.exit, causing Scrapy to import and execute it. This issue allows for potential process termination via malicious Referrer-Policy header. Defenders should verify Scrapy version and RefererMiddleware usage, and prioritize upgrading to Scrapy 2.14.2 or later. Evidence is limited to public sources and CVE record details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.