PYSEC-2022-159

    Dashboard / Vulnerabilities / PYSEC-2022-159

    PYSEC-2022-159

    Published: 2 Mar 2022Last Modified: 9 Oct 2025

    Summary:

    Details: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1.

    References: https://github.com/scrapy/scrapy/commit/8ce01b3b76d4634f55067d6cfdf632ec70ba304a, https://huntr.dev/bounties/3da527b1-2348-4f69-9e88-2e11a96ac585, https://github.com/advisories/GHSA-cjvr-mfj7-j4j8

    Affected packages

    Package

    Name: scrapy

    Purl: pkg:pypi/scrapy

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -8ce01b3b76d4634f55067d6cfdf632ec70ba304a

    Affected versions

    0.10.4.2364

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    PYSEC-2022-159 | CVE-DB