CVE-2022-0577: Sensitive Information Exposure in scrapy/scrapy
Summary
CVE-2022-0577: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1. Affects scrapy across 2 version ranges.
< 2.6.1
< 8ce01b3b76d4634f55067d6cfdf632ec70ba304a
Fixed in 8ce01b3b76d4634f55067d6cfdf632ec70ba304a. How to fix ↓
Also tracked for
- python-scrapy · Debian:11
The same CVE-2022-0577 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Scrapy is a Python framework used for web scraping and crawling. It provides a set of tools and libraries to extract data from websites. The vulnerability identified as CVE-2022-0577 allows an unauthorized actor to access sensitive information in the GitHub repository of scrapy/scrapy prior to version 2.6.1.
Vulnerability Detail
The vulnerability arises from a flaw in the GitHub repository of scrapy/scrapy. It allows an unauthorized actor to gain access to sensitive information. This could lead to the exposure of confidential data, such as API keys, passwords, or other sensitive credentials. The vulnerability was introduced in the initial version of scrapy and was fixed in commit 8ce01b3b76d4634f55067d6cfdf632ec70ba304a. The fix is included in version 2.6.1 of scrapy.
How To Fix
Latest published version: 2.19.0 as of 22 Oct 2026
pip install --upgrade "scrapy==2.19.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8ce01b3b76d4634f55067d6cfdf632ec70ba304a
This is the first release that contains the fix.
pip install --upgrade "scrapy==8ce01b3b76d4634f55067d6cfdf632ec70ba304a"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to apply the fix by upgrading to the latest version of scrapy.
Conclusion
The vulnerability CVE-2022-0577 in scrapy/scrapy prior to version 2.6.1 exposes sensitive information to unauthorized actors. To mitigate this vulnerability, it is recommended to upgrade scrapy to version 2.6.1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for scrapy →
FAQ
Scrapy is a Python framework used for web scraping and crawling. It provides a set of tools and libraries to extract data from websites.
The vulnerability allows an unauthorized actor to access sensitive information in the GitHub repository of scrapy/scrapy. This could lead to the exposure of confidential data, such as API keys, passwords, or other sensitive credentials.
To fix the vulnerability, it is recommended to upgrade scrapy to version 2.6.1 or later. This can be done by updating the package using the package manager or by modifying the dependency version in the project's configuration file.
There is no specific workaround mentioned for this vulnerability. It is recommended to apply the fix by upgrading to the latest version of scrapy.
More information about this vulnerability can be found in the advisory database of the Python Package Index (PyPI) at the following source: https://github.com/pypa/advisory-database/blob/main/vulns/scrapy/PYSEC-2022-159.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for scrapy.
