PyPI/scrapy CVE-2026-84366: high 7.4, EPSS 0.25%

Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default

Action: Upgrade scrapy to 2.17.0 or later.

pip install scrapy==2.17.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-3918
• https://github.com/scrapy/scrapy/security/advisories/GHSA-76g3-c3x4-crvx
• https://nvd.nist.gov/vuln/detail/CVE-2026-84366
• https://github.com/scrapy/scrapy/commit/9523e1ec8c41fde265a26d14563d178b6f1ad04b
• https://github.com/scrapy/scrapy
• https://github.com/scrapy/scrapy/releases/tag/2.17.0
• https://pypi.org/project/scrapy
• https://github.com/advisories/GHSA-76g3-c3x4-crvx

CVE-2026-84366 · published 2026-09-10T09:44:59.789119Z · modified 2026-09-10T12:15:11.853400838Z · JSON