{"action":"Upgrade scrapy to 1.8.4 or later.","affected":[{"fixed":"2.11.1","introduced":"2"},{"fixed":"1.8.4","introduced":"0"}],"component":"scrapy","cve_ids":["CVE-2024-1892"],"ecosystem":"PyPI","epss":0.00557,"exploited":false,"fixed_versions":["2.11.1","1.8.4"],"ghsa_id":"GHSA-cc65-xxvf-f7r9","id":"tcs_01M5KFCNQSK9F3Y56789EXDP17","modified_at":"2025-01-14T17:20:10.367591Z","published_at":"2024-02-15T15:22:02Z","references":["https://osv.dev/vulnerability/GHSA-cc65-xxvf-f7r9","https://github.com/scrapy/scrapy/security/advisories/GHSA-cc65-xxvf-f7r9","https://github.com/scrapy/scrapy/commit/479619b340f197a8f24c5db45bc068fb8755f2c5","https://github.com/scrapy/scrapy/commit/73e7c0ed011a0565a1584b8052ec757b54e5270b","https://docs.scrapy.org/en/latest/news.html#scrapy-1-8-4-2024-02-14","https://docs.scrapy.org/en/latest/news.html#scrapy-2-11-1-2024-02-14","https://github.com/pypa/advisory-database/tree/main/vulns/scrapy/PYSEC-2024-162.yaml","https://github.com/scrapy/scrapy","https://huntr.com/bounties/271f94f2-1e05-4616-ac43-41752389e26b"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-cc65-xxvf-f7r9","url":"https://osv.dev/vulnerability/GHSA-cc65-xxvf-f7r9"}],"summary":"Scrapy vulnerable to ReDoS via XMLFeedSpider"}