Arbitrary Module Import Vulnerability in Scrapy: Referrer-Policy Header Exploit
Summary
GHSA-cwxj-rr6w-m6w7: Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware. Affects scrapy versions >= 1.4.0, < 2.14.2. Fixed in 2.14.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Scrapy is an open-source web crawling framework for Python, designed to facilitate the extraction of data from websites. It provides tools for handling requests, processing responses, and managing data pipelines. Since version 1.4.0, Scrapy has implemented a feature that respects the 'Referrer-Policy' response header, which determines how the 'Referer' header is set on follow-up requests. This feature, while useful, has introduced a significant security vulnerability that can be exploited by malicious actors.
Vulnerability Detail
The vulnerability arises from Scrapy's handling of the 'Referrer-Policy' header. If the header value resembles a valid Python import path, Scrapy will import and execute the referenced object, assuming it is a legitimate referrer policy class. This can lead to arbitrary code execution, as a malicious site could set the header to a path like 'sys.exit', causing Scrapy to terminate the process. This vulnerability has been present since version 1.4.0 and affects all versions up to 2.14.1.
How To Fix
Latest published version: 2.19.0 as of 22 Oct 2026
pip install --upgrade "scrapy==2.19.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.14.2
This is the first release that contains the fix.
pip install --upgrade "scrapy==2.14.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not an option, consider the following workarounds: 1. Disable the middleware by setting 'REFERER_ENABLED' to False in your settings. 2. Manually set the 'Referer' header on requests that require it. 3. Set the 'referrer_policy' in request metadata to prevent evaluating the 'Referrer-Policy' from responses. Example code to set the 'referrer_policy': Request(url, meta={'referrer_policy': 'scrapy.spidermiddlewares.referer.DefaultReferrerPolicy'})
Conclusion
The Scrapy framework has a critical vulnerability related to the handling of the Referrer-Policy header, which can lead to arbitrary code execution. Users are strongly advised to upgrade to version 2.14.2 or later to mitigate this risk. If an upgrade is not feasible, several workarounds can help reduce exposure to this vulnerability.
See every vulnerability recorded for scrapy →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
All versions of Scrapy from 1.4.0 up to 2.14.1 are affected by this vulnerability.
If you cannot upgrade, consider disabling the Referer middleware or manually setting the Referer header in your requests.
The Referrer-Policy header controls how much referrer information is passed when navigating from one page to another, enhancing privacy and security.
References
Related vulnerabilities
Recent vulnerabilities recorded for scrapy.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
