{"action":"Upgrade scrapy to 1.8.3 or later.","affected":[{"fixed":"1.8.3","introduced":"0"},{"fixed":"2.6.2","introduced":"2.0.0"}],"component":"scrapy","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["1.8.3","2.6.2"],"ghsa_id":"GHSA-9x8m-2xpf-crp3","id":"tcs_01M5KFBTFP68TSTC6BRTN5GK9N","modified_at":"2024-11-28T05:41:04.660880Z","published_at":"2022-07-29T22:26:57Z","references":["https://osv.dev/vulnerability/GHSA-9x8m-2xpf-crp3","https://github.com/scrapy/scrapy/security/advisories/GHSA-9x8m-2xpf-crp3","https://github.com/scrapy/scrapy/commit/af7dd16d8ded3e6cb2946603688f4f4a5212e80f","https://github.com/scrapy/scrapy"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-9x8m-2xpf-crp3","url":"https://osv.dev/vulnerability/GHSA-9x8m-2xpf-crp3"}],"summary":"Scrapy before 2.6.2 and 1.8.3 vulnerable to one proxy sending credentials to another"}