GHSA-mfjm-vh54-3f96
Scrapy cookie-setting is not restricted based on the public suffix list
Impact
Responses from domain names whose public domain name suffix contains 1 or more periods (e.g. responses from example.co.uk, given its public domain name suffix is co.uk) are able to set cookies that are included in requests to any other domain sharing the same domain name suffix.
Patches
Upgrade to Scrapy 2.6.0, which restricts cookies with their domain set to any of those in the public suffix list.
If you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.6.0 is not an option, you may upgrade to Scrapy 1.8.2 instead.
Workarounds
The only workaround for unpatched versions of Scrapy is to disable cookies altogether, or limit target domains to a subset that does not include domain names with one of the public domain suffixes affected (those with 1 or more periods).
References
For more information
If you have any questions or comments about this advisory:
- Open an issue
- Email us
What each source reports
GitHub AdvisoriesNo score
Scrapy cookie-setting is not restricted based on the public suffix list
Impact
Responses from domain names whose public domain name suffix contains 1 or more periods (e.g. responses from example.co.uk, given its public domain name suffix is co.uk) are able to set cookies that are included in requests to any other domain sharing the same domain name suffix.
Patches
Upgrade to Scrapy 2.6.0, which restricts cookies with their domain set to any of those in the public suffix list.
If you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.6.0 is not an option, you may upgrade to Scrapy 1.8.2 instead.
Workarounds
The only workaround for unpatched versions of Scrapy is to disable cookies altogether, or limit target domains to a subset that does not include domain names with one of the public domain suffixes affected (those with 1 or more periods).
References
For more information
If you have any questions or comments about this advisory:
- Open an issue
- Email us
- Record
GHSA-mfjm-vh54-3f96- Updated
- 2026-11-02
OSVNo score
Scrapy cookie-setting is not restricted based on the public suffix list
Impact
Responses from domain names whose public domain name suffix contains 1 or more periods (e.g. responses from example.co.uk, given its public domain name suffix is co.uk) are able to set cookies that are included in requests to any other domain sharing the same domain name suffix.
Patches
Upgrade to Scrapy 2.6.0, which restricts cookies with their domain set to any of those in the public suffix list.
If you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.6.0 is not an option, you may upgrade to Scrapy 1.8.2 instead.
Workarounds
The only workaround for unpatched versions of Scrapy is to disable cookies altogether, or limit target domains to a subset that does not include domain names with one of the public domain suffixes affected (those with 1 or more periods).
References
For more information
If you have any questions or comments about this advisory:
- Open an issue
- Email us
- Record
GHSA-mfjm-vh54-3f96- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
scrapyPyPI | before 1.8.2 | 1.8.2 |
scrapyPyPI | 2.0.0 up to 2.6.0 | 2.6.0 |
scrapyPyPI | before 1.8.2, plus listed versions 0.10.4.23640.12.0.25500.14.10.14.20.14.3 Show 45 moreShow less0.14.40.16.00.16.10.16.20.16.30.16.40.16.50.18.00.18.10.18.20.18.30.18.40.20.00.20.10.20.20.22.00.22.10.22.20.24.00.24.10.24.20.24.30.24.40.24.50.24.60.70.80.91.0.01.0.0rc11.0.0rc21.0.0rc31.0.11.0.21.0.31.0.41.0.51.0.61.0.71.1.01.1.0rc11.1.0rc21.1.0rc31.1.0rc41.1.1 | 1.8.2 |
scrapyPyPI | 2.0.0 up to 2.6.0, plus listed versions 2.0.12.1.02.2.02.2.12.3.0 Show 4 moreShow less2.4.02.4.12.5.02.5.1 | 2.6.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-mfjm-vh54-3f96 is a vulnerability with no CVSS score yet in scrapy, published March 1, 2022. No source lists public exploit code. Fixed in scrapy 1.8.2.
References
Left out here: 23 versions. The JSON record has them.