Is CVE-2026-105782 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-105782?

CVE-2026-105782 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-105782

Description

Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path as a referrer policy class, imported the referenced object, and called it. A malicious website could supply a callable such as sys.exit and terminate a crawler processing the response. This issue is fixed in version 2.14.2.