NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐍 PyPI
Not in CISA KEV

Scrapy cookie-setting is not restricted based on the public suffix listGHSA-mfjm-vh54-3f96

Fix: scrapy/scrapy@e865c44

GHSA-mfjm-vh54-3f96 is a security vulnerability in scrapy. A fix is available for scrapy — see the affected versions and patch details below.

Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Dec 7, 2024 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

2 pkgs affected
🐍scrapy🐍scrapy

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

Impact

Responses from domain names whose public domain name suffix contains 1 or more periods (e.g. responses from example.co.uk, given its public domain name suffix is co.uk) are able to set cookies that are included in requests to any other domain sharing the same domain name suffix.

Patches

Upgrade to Scrapy 2.6.0, which restricts cookies with their domain set to any of those in the public suffix list.

If you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.6.0 is not an option, you may upgrade to Scrapy 1.8.2 instead.

Workarounds

The only workaround for unpatched versions of Scrapy is to disable cookies altogether, or limit target domains to a subset that does not include domain names with one of the public domain suffixes affected (those with 1 or more periods).

References

For more information

If you have any questions or comments about this advisory:

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPIscrapyall versions1.8.2pip install --upgrade 'scrapy==1.8.2'
🐍PyPIscrapy≥ 2.0.0&&< 2.6.02.6.0pip install --upgrade 'scrapy==2.6.0'

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for scrapy, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update scrapy to 1.8.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-mfjm-vh54-3f96 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact Responses from domain names whose public domain name suffix contains 1 or more periods (e.g. responses from `example.co.uk`, given its public domain name suffix is `co.uk`) are able to set cookies that are included in requests to any other domain sharing the same domain name suffix. ### Patches Upgrade to Scrapy 2.6.0, which restricts cookies with their domain set to any of those in the [public suffix list](https://publicsuffix.org/). If you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.6.0 is not an option, you may upgrade to Scrapy 1.8.2 instead. ### Work
O3 Security · Impact-Aware SCA

Is GHSA-mfjm-vh54-3f96 in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works
Scrapy cookie-setting is not restricted based on the public…