How severe is CVE-2022-0577?

CVE-2022-0577 has a CVSS score of 8.8/10, rated HIGH. Immediate patching is strongly recommended.

Which packages are affected by CVE-2022-0577?

CVE-2022-0577 affects the following packages: scrapy (PyPI), scrapy (PyPI). Ecosystems affected: PyPI.

How do I fix CVE-2022-0577?

Update scrapy to 1.8.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2022-0577 is resolved across your whole dependency graph.

How do I detect CVE-2022-0577 in my PyPI dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for scrapy, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2022-0577 if there is no patch (or I can't update yet)?

Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.

Is CVE-2022-0577 actively exploited in the wild?

Yes. There are 1 known exploit references for CVE-2022-0577, including 1 in-the-wild exploitation observed on GitHub and other sources. Treat this as actively exploitable and prioritize patching immediately. All exploit code should only be run in an isolated sandbox environment for research or authorized testing — never against production systems without explicit written authorization.

What is the EPSS score for CVE-2022-0577?

CVE-2022-0577 has an EPSS (Exploit Prediction Scoring System) score of 1.2%, placing it in the 69th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority.

What type of vulnerability is CVE-2022-0577?

CVE-2022-0577 is classified as Information Exposure (CWE-200), CWE-863 (CWE-863). These weakness types describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation.

When was CVE-2022-0577 published, and has it been updated?

CVE-2022-0577 was published on March 2, 2022 and was last updated on October 28, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐍

🐍 PyPI

Not in CISA KEV

HIGH severity

CVE-2022-0577 — scrapy

HIGHFix: scrapy/scrapy@8ce01b3

CVE-2022-0577 is a high-severity (CVSS 8.8) Information Exposure vulnerability in scrapy. 1 public exploit or proof-of-concept reference is indexed, so weaponization risk is real. A fix is available for scrapy — see the affected versions and patch details below.

Exposure of Sensitive Information to an Unauthorized Actor in scrapy/scrapy

Also known asGHSA-cjvr-mfj7-j4j8PYSEC-2022-159

Published

Mar 2, 2022

Updated

Oct 28, 2026

Affected

2 pkgs

Patched

2 / 2

Exploits

1 known

Exploitation data as of Nov 6, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗

1.2%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs69th percentile — riskier than 69% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

2 pkgs affected

🐍scrapy🐍scrapy

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

Impact

If you manually define cookies on a Request object, and that Request object gets a redirect response, the new Request object scheduled to follow the redirect keeps those user-defined cookies, regardless of the target domain.

Patches

Upgrade to Scrapy 2.6.0, which resets cookies when creating Request objects to follow redirects¹, and drops the Cookie header if manually-defined if the redirect target URL domain name does not match the source URL domain name².

If you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.6.0 is not an option, you may upgrade to Scrapy 1.8.2 instead.

¹ At that point the original, user-set cookies have been processed by the cookie middleware into the global or request-specific cookiejar, with their domain restricted to the domain of the original URL, so when the cookie middleware processes the new (redirect) request it will incorporate those cookies into the new request as long as the domain of the new request matches the domain of the original request.

² This prevents cookie leaks to unintended domains even if the cookies middleware is not used.

Workarounds

If you cannot upgrade, set your cookies using a list of dictionaries instead of a single dictionary, as described in the Request documentation, and set the right domain for each cookie.

Alternatively, you can disable cookies altogether, or limit target domains to domains that you trust with all your user-set cookies.

References

Originally reported at huntr.dev

For more information

If you have any questions or comments about this advisory:

Affected Packages

2 total 2 fixed

Ecosystem	Package	Vulnerable range	Fix
🐍PyPI	`scrapy`	all versions	1.8.2`pip install --upgrade 'scrapy==1.8.2'`
🐍PyPI	`scrapy`	≥ 2.0.0&&< 2.6.0	2.6.0`pip install --upgrade 'scrapy==2.6.0'`

Affected Products

2 products · 2 configurations

debian linuxdebian

1 version

9.0

Application

scrapyscrapy

< 2.6.1

range

Exploits & PoCs

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

Exposure of Sensitive Information to an Unauthorized Actor in GitHub rep…

huntr.devNVDMar 2022

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for scrapy, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update scrapy to 1.8.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2022-0577 is resolved across your whole dependency graph.
Workarounds
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.

Frequently Asked Questions

### Impact If you manually define cookies on a [`Request`](https://docs.scrapy.org/en/latest/topics/request-response.html#scrapy.http.Request) object, and that `Request` object gets a redirect response, the new `Request` object scheduled to follow the redirect keeps those user-defined cookies, regardless of the target domain. ### Patches Upgrade to Scrapy 2.6.0, which resets cookies when creating `Request` objects to follow redirects¹, and drops the ``Cookie`` header if manually-defined if the redirect target URL domain name does not match the source URL domain name². If you are using Scra