Cloudanix VulnDB

GHSA-cwxj-rr6w-m6w7

High · 7.5

Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware

CVSS

7.5

EPSS

—

Published

Mar 13, 2026

CISA due date

—

The record

Since version 1.4.0, Scrapy respects the `Referrer-Policy` response header to decide whether and how to set a `Referer` header on follow-up requests. If the header value looked like a valid Python import path, Scrapy would import the referenced object and call it, assuming it referred to a referrer policy class (for example, `scrapy.spidermiddlewares.referer.DefaultReferrerPolicy`) and attempting to instantiate it to handle the `Referer` header. A malicious site could exploit this by setting `Referrer-Policy` to a path such as `sys.exit`, causing Scrapy to import and execute it and potentially terminate the process.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities