Scrapy
8 CVEs across 2 Scrapy products. Browse Scrapy vulnerabilities, severities, and proof-of-concept exploits.
Scrapy products with known CVEs
Scrapy CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2025-6176 | High | 7.5 | 2025-10-31 | Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechan… |
CVE-2024-1968 | High | 7.5 | 2024-05-20 | In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme (e.g., HTTPS to HTTP) but… |
CVE-2024-3574 | High | 7.5 | 2024-04-16 | In scrapy version 2.10.1, an issue was identified where the Authorization header, containing credentials for server authentication, is leaked to a third-party… |
CVE-2024-3572 | High | 7.5 | 2024-04-16 | The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without pro… |
CVE-2024-1892 | Medium | 6.5 | 2024-02-28 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML… |
CVE-2022-0577 | Medium | 6.5 | 2022-03-02 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1. |
CVE-2021-41125 | Medium | 5.7 | 2021-10-06 | Scrapy is a high-level web crawling and scraping framework for Python. If you use `HttpAuthMiddleware` (i.e. the `http_user` and `http_pass` spider attributes)… |
CVE-2017-14158 | High | 7.5 | 2017-09-05 | Scrapy 1.4 allows remote attackers to cause a denial of service (memory consumption) via large files because arbitrarily many files are read into memory, which… |