{"action":"Upgrade scrapy to 2.11.2 or later.","affected":[{"fixed":"2.11.2","introduced":"0"}],"component":"scrapy","cve_ids":["CVE-2024-1968"],"ecosystem":"PyPI","epss":0.00688,"exploited":false,"fixed_versions":["2.11.2"],"ghsa_id":"GHSA-4qqq-9vqf-3h3f","id":"tcs_01M5KEYVKXWED1K8HCW456Q5E4","modified_at":"2025-07-15T18:12:02.837491Z","published_at":"2024-05-14T20:14:33Z","references":["https://osv.dev/vulnerability/GHSA-4qqq-9vqf-3h3f","https://github.com/scrapy/scrapy/security/advisories/GHSA-4qqq-9vqf-3h3f","https://github.com/scrapy/scrapy/commit/1d0502f25bbe55a22899af915623fda1aaeb9dd8","https://github.com/scrapy/scrapy","https://huntr.com/bounties/27f6a021-a891-446a-ada5-0226d619dd1a"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-4qqq-9vqf-3h3f","url":"https://osv.dev/vulnerability/GHSA-4qqq-9vqf-3h3f"}],"summary":"Scrapy leaks the authorization header on same-domain but cross-origin redirects"}