CVE-2026-105782

Summary

Scrapy's RefererMiddleware incorrectly interpreted Referrer-Policy header values as Python import paths and attempted to import and execute them as referrer policy classes. This allowed remote attackers to inject arbitrary Python code that could terminate crawlers by calling functions like sys.exit.

Exploitability

Exploitation requires a malicious website to serve a response with a specially crafted Referrer-Policy header, making it moderately difficult to exploit without direct control over a web server but possible through phishing or compromised sites.

Blast radius

The impact is limited to crawler processes that encounter the malicious response, potentially causing crawlers to terminate unexpectedly and halting data collection workflows, but does not directly affect end-user applications or systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Scrapy version 2.14.2 or later to fix the referer middleware vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.