Information disclosure in scrapy - #VU162976
Published: November 9, 2026
Vulnerability identifier: #VU162976
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to expose internal HTTP requests to an environment-configured proxy.
The vulnerability exists due to Scrapy's redirect middlewares retaining the original proxy on same-scheme redirects to hosts matching no_proxy when http_proxy or https_proxy is configured. An unauthenticated remote attacker can serve a redirect from a website crawled by Scrapy to an excluded internal HTTP host, disclosing any cookies or credentials sent for that host to the proxy.
Affected software
scrapy
Remediation
Install security update from vendor's website.
scrapy - update to 2.20.0