CVE-2026-105782

Name of the Vulnerable Software and Affected Versions Scrapy versions 1.4.0 through 2.14.1

Description RefererMiddleware in scrapy/spidermiddlewares/referer.py incorrectly handles the Referrer-Policy response header. If the header value resembles a Python import path, the framework imports the referenced object and executes it, assuming it is a referrer policy class. A malicious website can exploit this by providing a callable, such as sys.exit, to terminate the crawler process.

Recommendations Update to version 2.14.2. Set REFERER ENABLED to False to disable the middleware. Disable the middleware and manually set the Referer header on required requests. Set the referrer policy meta key on all requests to prevent the evaluation of the Referrer-Policy header from responses. Disable the built-in referrer policy middleware by setting it to None in SPIDER MIDDLEWARES and replace it with the fixed implementation from version 2.14.2.