CVE-2026-105782: Scrapy Arbitrary Module Import via Referrer-Policy Header Vulnerability
Summary
CVE-2026-105782: Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware. Affects scrapy versions >= 1.4.0, < 2.14.2. Fixed in 2.14.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Scrapy is a powerful open-source web crawling and web scraping framework for Python. It allows developers to extract data from websites efficiently and provides tools for handling requests, responses, and data storage. Since version 1.4.0, Scrapy has included a feature that respects the 'Referrer-Policy' response header to determine how to set the 'Referer' header on follow-up requests. This feature, while useful, has introduced a vulnerability that can be exploited by malicious sites.
Vulnerability Detail
The vulnerability arises from Scrapy's handling of the 'Referrer-Policy' header. If the header value resembles a valid Python import path, Scrapy will import and execute the referenced object, assuming it is a referrer policy class. This can lead to arbitrary code execution, as a malicious site could set the header to a path like 'sys.exit', which would terminate the Scrapy process. This vulnerability has been present since version 1.4.0 and can have severe consequences for applications using Scrapy, potentially leading to denial of service.
How To Fix
Latest published version: 2.19.0 as of 22 Oct 2026
pip install --upgrade "scrapy==2.19.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.14.2
This is the first release that contains the fix.
pip install --upgrade "scrapy==2.14.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not feasible, consider the following workarounds: 1. Disable the middleware by setting 'REFERER_ENABLED' to False in your Scrapy settings. 2. Manually set the 'Referer' header on requests that require it, as shown below:
Request(
url,
headers={
'Referer': 'your_custom_referer'
}
)
- Set the 'referrer_policy' in request metadata to prevent evaluating the 'Referrer-Policy' from preceding responses:
Request(
url,
meta={
'referrer_policy': 'scrapy.spidermiddlewares.referer.DefaultReferrerPolicy',
},
)
- Implement a custom spider middleware to set the 'referrer_policy' meta key before the built-in middleware runs.
Conclusion
The Scrapy vulnerability CVE-2026-105782 poses a significant risk due to its potential for arbitrary code execution via the 'Referrer-Policy' header. It is crucial to upgrade to version 2.14.2 or later to mitigate this risk. If upgrading is not possible, implementing the suggested workarounds can help protect your application.
See every vulnerability recorded for scrapy →
FAQ
CVE-2026-105782 is a vulnerability in Scrapy that allows arbitrary module imports via the 'Referrer-Policy' header, potentially leading to code execution.
You can check if your application is affected by using the Vulert playground at Vulert Scanner without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
If you cannot upgrade, consider disabling the middleware or manually setting the 'Referer' header as workarounds.
More information about Scrapy can be found on its official documentation site at https://docs.scrapy.org.
References
Related vulnerabilities
Recent vulnerabilities recorded for scrapy.
