PatchTheCVEscrapy vulnerabilities
Recent CVEs affecting scrapy products. 4 tracked.
scrapy has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2024-05-20. Highest priority: CVE-2024-3572 (score 50/100).
- CVE-2024-3574 HIGH 7.5 UPGRADE In scrapy version 2.10.1, an issue was identified where the Authorization header, containing credentials for s
- CVE-2024-3572 HIGH 7.5 UPGRADE The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.from
- CVE-2024-1968 HIGH 7.5 UPGRADE In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that
- CVE-2024-1892 MEDIUM 6.5 UPGRADE A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/s
FAQ
How do I fix scrapy vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is scrapy being exploited right now?
None of the tracked scrapy CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which scrapy CVE should I patch first?
CVE-2024-3572 currently ranks highest (50/100): The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.from.