SB20261109165 - Multiple vulnerabilities in scrapy

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109165

SB20261109165 - Multiple vulnerabilities in scrapy

Published: November 9, 2026

Security Bulletin ID SB20261109165
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Cleartext transmission of sensitive information (CVE-ID: N/A)

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated network attacker to read uploaded files and authentication metadata and falsify storage results.

The vulnerability exists due to plaintext HTTP requests from Scrapy's files and images pipelines when FILES_STORE or IMAGES_STORE targets S3 without explicitly enabling HTTPS. An unauthenticated network attacker can intercept this traffic to inspect uploads or forge responses that cause files to be skipped or falsely reported as stored.


2) Insufficiently protected credentials (CVE-ID: N/A)

CWE-ID: CWE-522 - Insufficiently Protected Credentials

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to steal HTTP authentication credentials from requests made by Scrapy.

The vulnerability exists due to Scrapy's HttpAuthMiddleware restoring credentials from retained http_user and http_pass request metadata after cross-domain redirects when http_auth_domain is unset. An unauthenticated remote attacker can make a website visited by the crawler redirect a credential-bearing request to an attacker-controlled host, causing Scrapy to send the credentials to that host.


3) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to expose internal HTTP requests to an environment-configured proxy.

The vulnerability exists due to Scrapy's redirect middlewares retaining the original proxy on same-scheme redirects to hosts matching no_proxy when http_proxy or https_proxy is configured. An unauthenticated remote attacker can serve a redirect from a website crawled by Scrapy to an excluded internal HTTP host, disclosing any cookies or credentials sent for that host to the proxy.


4) Improper handling of highly compressed data (CVE-ID: N/A)

CWE-ID: CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to cause denial of service in a Scrapy crawler through excessive CPU and memory usage.

The vulnerability exists due to unbounded decoding of chained content codings by Scrapy's HttpCompressionMiddleware when processing a response with a Content-Encoding header. An unauthenticated remote attacker can serve a response from a server the crawler visits with thousands of chained codings and a repeatedly compressed body, forcing repeated decompression.


5) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker controlling crawled content to cause local file reads or steal configured FTP credentials.

The vulnerability exists due to insufficient URL scheme restrictions in Scrapy's LinkExtractor and SitemapSpider when processing crawled content. An unauthenticated remote attacker can inject file:// or ftp:// URLs to pass local files to spider callbacks or send FTP credentials to an attacker-controlled server, provided allowed_domains is unset for file access or permits the FTP host.


Remediation

Install update from vendor's website.

References