Scrapy CVE-2026-105782

Exploitable only when a Scrapy crawler running versions 1.4.0 through 2.14.1 fetches a response from an attacker-controlled web server while the built-in RefererMiddleware is enabled (the default state, REFERER_ENABLED=True) and no per-request 'referrer_policy' meta key overrides policy evaluation. The attacker sets the Referrer-Policy response header to a value resembling a Python import path (e.g. 'sys.exit'), which Scrapy imports and calls. Limiting factors: the crawler must actually request the malicious page (crawlers confined to trusted domains are not exposed), and impact is constrained to objects that are importable and invokable with no arguments, so realistic effect is process termination/DoS rather than general arbitrary code execution. Available mitigations without upgrading include setting REFERER_ENABLED=False or pinning the referrer_policy request meta key.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5 HIGH) is internally consistent and matches the description: a network-reachable, unauthenticated, low-complexity flaw whose entire severity comes from availability impact (A:H) with no confidentiality or integrity effect. This is CWE-470 (unsafe reflection) - the RefererMiddleware imported and called an object named in an attacker-controlled Referrer-Policy response header. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence set; SSVC decision data was also not supplied, so exploitation-probability and automatability signals are absent and cannot be weighed. Practically, exploitation requires that the Scrapy crawler fetch a response from an attacker-controlled site, which is trivial for broad/open crawlers but not for scrapers limited to trusted domains. The realistic impact is denial of service (crashing the crawler via callables like sys.exit), not arbitrary code execution or data theft - so despite the HIGH score this is a moderate operational priority rather than a critical remote-code-execution emergency. Note a signal conflict: the input Tags include 'Information Disclosure', which contradicts the C:N/A:H impact profile and appears mislabeled.

An operator runs a Scrapy crawler that follows links across arbitrary or untrusted sites. An attacker stands up a web page that returns the HTTP response header 'Referrer-Policy: sys.exit'; when the crawler processes the response, the vulnerable RefererMiddleware imports and invokes that callable, terminating the crawler process. No public exploit code was identified at time of analysis, though the one-line payload is described explicitly in the vendor advisory.