CVE-2020-7698: Command Injection in Gerapy
Summary
CVE-2020-7698: Command injection in Gerapy. Affects gerapy versions < 0.9.3. Fixed in 0.9.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gerapy is an open-source package available on PyPI that provides a web-based user interface for managing and monitoring Scrapy projects. It allows users to configure projects, view job lists and logs, cancel jobs, and perform other related tasks. However, versions 0 to 0.9.3 of Gerapy are vulnerable to command injection.
Vulnerability Detail
The vulnerability in Gerapy arises from unsanitized input being passed to the Popen function via the project_configure endpoint. This allows an attacker to execute arbitrary commands on the system hosting Gerapy. The impact of this vulnerability can be severe, as an attacker can potentially gain unauthorized access, modify data, or disrupt the functionality of the system.
How To Fix
Latest published version: 0.9.13 as of 22 Oct 2026
pip install --upgrade "gerapy==0.9.13"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.9.3
This is the first release that contains the fix.
pip install --upgrade "gerapy==0.9.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading Gerapy is not immediately feasible, a temporary workaround can be implemented by manually sanitizing the input before passing it to the Popen function. Here is an example of how to sanitize the input in Python:
import shlex
from subprocess import Popen
input_command = 'user_input'
command = shlex.split(input_command)
Popen(command)
Conclusion
In conclusion, the vulnerability in Gerapy allows for command injection, which can have severe consequences on the affected system. It is crucial to upgrade to the latest version of Gerapy or apply the provided workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for gerapy →
FAQ
Gerapy is an open-source package that provides a web-based user interface for managing and monitoring Scrapy projects.
Command injection is a security vulnerability that allows an attacker to execute arbitrary commands on a targeted system.
This vulnerability in Gerapy can lead to unauthorized access, data manipulation, and disruption of system functionality.
The recommended fix is to upgrade Gerapy to version 0.9.3 or later, which includes proper input sanitization.
Yes, a temporary workaround is to manually sanitize the input before passing it to the Popen function. Refer to the 'workaround' section for an example.
Related vulnerabilities
Recent vulnerabilities recorded for gerapy.
