Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

Version	Supported
2.11.x	✅
< 2.11.x	❌

Reporting a Vulnerability

Please report the vulnerability using https://github.com/scrapy/scrapy/security/advisories/new.

ReDos vulnerability of XMLFeedSpider
GHSA-cc65-xxvf-f7r9 published Feb 14, 2024 by Gallaecio

High
Decompression bomb vulnerability
GHSA-7j7m-v7m3-jqm7 published Feb 14, 2024 by Gallaecio

High
Authorization header leakage on cross-domain redirect
GHSA-cw9j-q3vf-hrrv published Feb 14, 2024 by Gallaecio

High
Credentials of one proxy may be sent to another
GHSA-9x8m-2xpf-crp3 published Jul 25, 2022 by Gallaecio

Moderate
Cookie-setting is not restricted based on the public suffix list
GHSA-mfjm-vh54-3f96 published Mar 1, 2022 by Gallaecio

Moderate
User-set cookies are kept on redirect requests regardless of the target domain
GHSA-cjvr-mfj7-j4j8 published Mar 1, 2022 by Gallaecio

Moderate
HTTP authentication credentials potentially leaked to target websites
GHSA-jwqp-28gf-p498 published Oct 6, 2021 by Gallaecio

Moderate

Learn more about advisories related to scrapy/scrapy in the GitHub Advisory Database