Scrapy

8 CVEs across 2 Scrapy products. Browse Scrapy vulnerabilities, severities, and proof-of-concept exploits.

Scrapy products with known CVEs

ProductCVEs
Scrapy7
Scrapy/scrapy6
Scrapy CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2025-6176High7.52025-10-31Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechan…
CVE-2024-1968High7.52024-05-20In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme (e.g., HTTPS to HTTP) but…
CVE-2024-3574High7.52024-04-16In scrapy version 2.10.1, an issue was identified where the Authorization header, containing credentials for server authentication, is leaked to a third-party…
CVE-2024-3572High7.52024-04-16The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without pro…
CVE-2024-1892Medium6.52024-02-28A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML…
CVE-2022-0577Medium6.52022-03-02Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1.
CVE-2021-41125Medium5.72021-10-06Scrapy is a high-level web crawling and scraping framework for Python. If you use `HttpAuthMiddleware` (i.e. the `http_user` and `http_pass` spider attributes)…
CVE-2017-14158High7.52017-09-05Scrapy 1.4 allows remote attackers to cause a denial of service (memory consumption) via large files because arbitrarily many files are read into memory, which…