CVE-2020-7698: Gerapy Package Command Injection
Summary
CVE-2020-7698: This affects the package Gerapy from 0 and before 0.9.3. The input being passed to Popen, via the project_configure endpoint, isn’t being sanitized. Affects gerapy across 2 version ranges.
< 0.9.3
< e8446605eb2424717418eae199ec7aad573da2d2
Fixed in e8446605eb2424717418eae199ec7aad573da2d2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gerapy is a Python package available on PyPI that provides a web-based user interface for managing Scrapy projects. It allows users to easily create, deploy, and monitor Scrapy spiders. The package is widely used in web scraping and data extraction projects. However, versions prior to 0.9.3 are vulnerable to a command injection attack.
Vulnerability Detail
The vulnerability in Gerapy arises from unsanitized input being passed to the Popen function via the project_configure endpoint. This allows an attacker to execute arbitrary commands on the system where Gerapy is installed. The impact of this vulnerability can be severe, as it enables unauthorized access, data theft, and potential system compromise. It is crucial to address this issue promptly to prevent any malicious activities.
How To Fix
Latest published version: 0.9.13 as of 22 Oct 2026
pip install --upgrade "gerapy==0.9.13"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
e8446605eb2424717418eae199ec7aad573da2d2
This is the first release that contains the fix.
pip install --upgrade "gerapy==e8446605eb2424717418eae199ec7aad573da2d2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement input validation and sanitization on the affected endpoint to prevent command injection. It is essential to ensure that any user-supplied input is properly validated and sanitized before passing it to the Popen function. Here is an example of how input validation can be implemented in Python:
import subprocess
def execute_command(command):
if ';' in command or '|' in command:
raise ValueError('Invalid characters in command')
subprocess.Popen(command, shell=True)
Conclusion
The command injection vulnerability in Gerapy can have severe consequences if left unaddressed. It is crucial to update to version 0.9.3 or later to mitigate the risk. Implementing input validation and sanitization on the affected endpoint can serve as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for gerapy →
FAQ
Gerapy is a Python package that provides a web-based user interface for managing Scrapy projects. It simplifies the process of creating, deploying, and monitoring Scrapy spiders.
This vulnerability allows an attacker to execute arbitrary commands on the system where Gerapy is installed. It can lead to unauthorized access, data theft, and potential system compromise.
To fix this vulnerability, update Gerapy to version 0.9.3 or later by running 'pip install --upgrade gerapy'.
As a temporary workaround, implement input validation and sanitization on the affected endpoint to prevent command injection. Ensure that user-supplied input is properly validated and sanitized before passing it to the Popen function.
For more information about this vulnerability, refer to the Gerapy advisory PYSEC-2020-44 at https://github.com/pypa/advisory-database/blob/main/vulns/gerapy/PYSEC-2020-44.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for gerapy.
