{"id":"CVE-2022-0577","aliases":["DEBIAN-CVE-2022-0577","DLA-2950-1","EUVD-2022-0275","GHSA-cjvr-mfj7-j4j8","PYSEC-2022-159","UBUNTU-CVE-2022-0577","USN-7476-1","openSUSE-SU-2024:11889-1"],"status":"published","title":"Exposure of Sensitive Information to an Unauthorized Actor in scrapy/scrapy","description":"Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01228,"percentile":0.69093,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-863"],"published":"2022-03-01T22:12:47Z","modified":"2026-11-03T08:00:04Z","fixes":[{"ecosystem":"PyPI","package":"scrapy","fixed_in":["1.8.2","2.6.0","2.6.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-scrapy","fixed_in":["2.6.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-scrapy","fixed_in":["2.6.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-scrapy","fixed_in":["2.6.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-scrapy","fixed_in":["1.5.0-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-scrapy","fixed_in":["1.7.3-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-scrapy","fixed_in":["2.5.1-2ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.6.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"python-scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-2+deb9u1"}]}],"versions":["1.0.3-2"],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2"}]}],"versions":["0.10.4.2364","0.12.0.2550","0.14.1","0.14.2","0.14.3","0.14.4","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.16.5","0.18.0","0.18.1","0.18.2","0.18.3","0.18.4","0.20.0","0.20.1","0.20.2","0.22.0","0.22.1","0.22.2","0.24.0","0.24.1","0.24.2","0.24.3","0.24.4","0.24.5","0.24.6","0.7","0.8","0.9","1.0.0","1.0.0rc1","1.0.0rc2","1.0.0rc3","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.0rc1","1.1.0rc2","1.1.0rc3","1.1.0rc4","1.1.1","1.1.2","1.1.3","1.1.4","1.2.0","1.2.1","1.2.2","1.2.3","1.3.0","1.3.1","1.3.2","1.3.3","1.4.0","1.5.0","1.5.1","1.5.2","1.6.0","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.8.0","1.8.1"]},{"source":"osv","ecosystem":"PyPI","package":"scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.6.0"}]}],"versions":["2.0.0","2.0.1","2.1.0","2.2.0","2.2.1","2.3.0","2.4.0","2.4.1","2.5.0","2.5.1"]},{"source":"osv","ecosystem":"PyPI","package":"scrapy","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"8ce01b3b76d4634f55067d6cfdf632ec70ba304a"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1"}]}],"versions":["0.10.4.2364","0.12.0.2550","0.14.1","0.14.2","0.14.3","0.14.4","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.16.5","0.18.0","0.18.1","0.18.2","0.18.3","0.18.4","0.20.0","0.20.1","0.20.2","0.22.0","0.22.1","0.22.2","0.24.0","0.24.1","0.24.2","0.24.3","0.24.4","0.24.5","0.24.6","0.7","0.8","0.9","1.0.0","1.0.0rc1","1.0.0rc2","1.0.0rc3","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.0rc1","1.1.0rc2","1.1.0rc3","1.1.0rc4","1.1.1","1.1.2","1.1.3","1.1.4","1.2.0","1.2.1","1.2.2","1.2.3","1.3.0","1.3.1","1.3.2","1.3.3","1.4.0","1.5.0","1.5.1","1.5.2","1.6.0","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.8.0","1.8.1","1.8.2","2.0.0","2.0.1","2.1.0","2.2.0","2.2.1","2.3.0","2.4.0","2.4.1","2.5.0","2.5.1","2.6.0","1.8.3","1.8.4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0-1","1.0.3-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-1ubuntu0.1~esm1"}]}],"versions":["1.3.0-1~exp2","1.4.0-1","1.5.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.3-1ubuntu0.1~esm1"}]}],"versions":["1.7.3-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-2ubuntu0.1~esm1"}]}],"versions":["2.4.1-2","2.5.1-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-1ubuntu0.1~esm1"}]}],"versions":["1.3.0-1~exp2","1.4.0-1","1.5.0-1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.3-1ubuntu0.1~esm1"}]}],"versions":["1.7.3-1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-2ubuntu0.1~esm1"}]}],"versions":["2.4.1-2","2.5.1-2"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.1-1ubuntu0.1~esm2"}]}],"versions":["2.10.0-1","2.11.0-1","2.11.0-2","2.11.1-1"],"bundled":6}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"scrapy","product":"scrapy"},{"vendor":"scrapy","product":"scrapy/scrapy"}],"references":[{"url":"https://huntr.dev/bounties/3da527b1-2348-4f69-9e88-2e11a96ac585","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","web","report"]},{"url":"https://github.com/scrapy/scrapy/commit/8ce01b3b76d4634f55067d6cfdf632ec70ba304a","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00021.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://github.com/scrapy/scrapy/security/advisories/GHSA-cjvr-mfj7-j4j8","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0577","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/scrapy/PYSEC-2022-159.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cjvr-mfj7-j4j8","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0577.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-0577","tags":["advisory"]},{"url":"https://github.com/scrapy/scrapy","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2022-0577","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0577","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7476-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-41125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-1892","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-1968","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-3572","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-3574","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0577","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-0577","title":"Exposure of Sensitive Information to an Unauthorized Actor in scrapy/scrapy","description":"Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1.","status":"published","published":"2022-03-02T04:05:10Z","modified":"2024-08-02T23:32:46.259Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:34:41.69911Z"}],"euvd":[{"id":"EUVD-2022-0275","description":"Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1.","status":"published","published":"2022-03-02T04:05:10Z","modified":"2024-08-02T23:32:46Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:26:04.946671Z"}],"ghsa":[{"id":"GHSA-cjvr-mfj7-j4j8","title":"Incorrect Authorization and Exposure of Sensitive Information to an Unauthorized Actor in scrapy","description":"### Impact\n\nIf you manually define cookies on a [`Request`](https://docs.scrapy.org/en/latest/topics/request-response.html#scrapy.http.Request) object, and that `Request` object gets a redirect response, the new `Request` object scheduled to follow the redirect keeps those user-defined cookies, regardless of the target domain.\n\n### Patches\n\nUpgrade to Scrapy 2.6.0, which resets cookies when creating `Request` objects to follow redirects¹, and drops the ``Cookie`` header if manually-defined if the redirect target URL domain name does not match the source URL domain name².\n\nIf you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.6.0 is not an option, you may upgrade to Scrapy 1.8.2 instead.\n\n¹ At that point the original, user-set cookies have been processed by the cookie middleware into the global or request-specific cookiejar, with their domain restricted to the domain of the original URL, so when the cookie middleware processes the new (redirect) request it will incorporate those cookies into the new request as long as the domain of the new request matches the domain of the original request.\n\n² This prevents cookie leaks to unintended domains even if the cookies middleware is not used.\n\n### Workarounds\n\nIf you cannot upgrade, set your cookies using a list of dictionaries instead of a single dictionary, as described in the [`Request` documentation](https://docs.scrapy.org/en/latest/topics/request-response.html#scrapy.http.Request), and set the right domain for each cookie.\n\nAlternatively, you can [disable cookies altogether](https://docs.scrapy.org/en/latest/topics/downloader-middleware.html#std-setting-COOKIES_ENABLED), or [limit target domains](https://docs.scrapy.org/en/latest/topics/spiders.html#scrapy.spiders.Spider.allowed_domains) to domains that you trust with all your user-set cookies.\n\n### References\n* Originally reported at [huntr.dev](https://huntr.dev/bounties/3da527b1-2348-4f69-9e88-2e11a96ac585/)\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* [Open an issue](https://github.com/scrapy/scrapy/issues)\n* [Email us](mailto:opensource@zyte.com)","status":"published","published":"2022-03-01T22:12:47Z","modified":"2026-09-24T14:44:32Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-863"],"updated_at":"2026-11-02T14:41:21.616682Z"}],"nvd":[{"id":"CVE-2022-0577","description":"Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1.","status":"published","published":"2022-03-02T04:15:06.96Z","modified":"2026-06-17T04:20:52.573Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200","CWE-863"],"updated_at":"2026-11-02T14:07:12.711288Z"}],"osv":[{"id":"CVE-2022-0577","title":"Exposure of Sensitive Information to an Unauthorized Actor in scrapy/scrapy","description":"Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1.","status":"published","published":"2022-03-02T04:05:10Z","modified":"2026-10-28T02:30:28.94485587Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:22.824781Z"},{"id":"DEBIAN-CVE-2022-0577","description":"Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1.","status":"published","published":"2022-03-02T04:15:06.96Z","modified":"2026-11-03T08:00:04.769376152Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T08:25:15.646766Z"},{"id":"GHSA-cjvr-mfj7-j4j8","title":"Incorrect Authorization and Exposure of Sensitive Information to an Unauthorized Actor in scrapy","description":"### Impact\n\nIf you manually define cookies on a [`Request`](https://docs.scrapy.org/en/latest/topics/request-response.html#scrapy.http.Request) object, and that `Request` object gets a redirect response, the new `Request` object scheduled to follow the redirect keeps those user-defined cookies, regardless of the target domain.\n\n### Patches\n\nUpgrade to Scrapy 2.6.0, which resets cookies when creating `Request` objects to follow redirects¹, and drops the ``Cookie`` header if manually-defined if the redirect target URL domain name does not match the source URL domain name².\n\nIf you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.6.0 is not an option, you may upgrade to Scrapy 1.8.2 instead.\n\n¹ At that point the original, user-set cookies have been processed by the cookie middleware into the global or request-specific cookiejar, with their domain restricted to the domain of the original URL, so when the cookie middleware processes the new (redirect) request it will incorporate those cookies into the new request as long as the domain of the new request matches the domain of the original request.\n\n² This prevents cookie leaks to unintended domains even if the cookies middleware is not used.\n\n### Workarounds\n\nIf you cannot upgrade, set your cookies using a list of dictionaries instead of a single dictionary, as described in the [`Request` documentation](https://docs.scrapy.org/en/latest/topics/request-response.html#scrapy.http.Request), and set the right domain for each cookie.\n\nAlternatively, you can [disable cookies altogether](https://docs.scrapy.org/en/latest/topics/downloader-middleware.html#std-setting-COOKIES_ENABLED), or [limit target domains](https://docs.scrapy.org/en/latest/topics/spiders.html#scrapy.spiders.Spider.allowed_domains) to domains that you trust with all your user-set cookies.\n\n### References\n* Originally reported at [huntr.dev](https://huntr.dev/bounties/3da527b1-2348-4f69-9e88-2e11a96ac585/)\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* [Open an issue](https://github.com/scrapy/scrapy/issues)\n* [Email us](mailto:opensource@zyte.com)","status":"published","published":"2022-03-01T22:12:47Z","modified":"2026-09-24T15:00:05.276642539Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-863"],"updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"UBUNTU-CVE-2022-0577","description":"Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1.","status":"published","published":"2022-03-02T04:15:00Z","modified":"2026-02-04T03:46:52.427234Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:51.630172Z"},{"id":"DLA-2950-1","title":"python-scrapy - security update","status":"published","published":"2022-03-16T00:00:00Z","modified":"2026-03-09T01:23:33.254476Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"openSUSE-SU-2024:11889-1","title":"python-Scrapy-doc-2.6.1-1.1 on GA media","description":"These are all security issues fixed in the python-Scrapy-doc-2.6.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:27:08.080863Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"PYSEC-2022-159","description":"Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1.","status":"published","published":"2022-03-02T04:15:00Z","modified":"2025-10-09T08:23:09.449118Z","updated_at":"2026-11-02T15:52:53.449407Z"},{"id":"USN-7476-1","title":"python-scrapy vulnerabilities","description":"It was discovered that Scrapy improperly exposed HTTP authentication \ncredentials to request targets, including during redirects. An attacker \ncould use this issue to gain unauthorized access to user accounts. This\nissue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-41125)\n\nIt was discovered that Scrapy did not remove the cookie header during\ncross-domain redirects. An attacker could possibly use this issue to gain\nunauthorized access to user accounts. This issue only affected Ubuntu 18.04\nLTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-0577)\n\nIt was discovered that Scrapy inefficiently parsed XML content. An\nattacker could use this issue to cause a denial of service by sending a\ncrafted XML response. This issue only affected Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2024-1892)\n\nIt was discovered that Scrapy did not properly check response size during\ndecompression. An attacker could send a crafted response that would\nexhaust memory and cause a denial of service. This issue only affected\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2024-3572)\n\nIt was discovered that Scrapy did not remove the authorization header\nduring cross-domain redirects. An attacker could possibly use this issue\nto gain unauthorized access to user accounts. This issue only affected \nUbuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2024-3574)\n\nIt was discovered that Scrapy did not remove the authorization header\nduring redirects that change scheme but remain in the same domain. This\nissue could possibly be used by an attacker to expose sensitive \ninformation or to gain unauthorized access to user accounts.\n(CVE-2024-1968)\n\n","status":"published","published":"2025-05-05T16:31:52Z","modified":"2026-04-27T18:02:20.75951352Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}