{"action":"Upgrade scrapy to 1.8.2 or later.","affected":[{"fixed":"1.8.2","introduced":"0"},{"fixed":"2.6.0","introduced":"2.0.0"}],"component":"scrapy","cve_ids":["CVE-2022-0577"],"ecosystem":"PyPI","epss":0.01228,"exploited":false,"fixed_versions":["1.8.2","2.6.0"],"ghsa_id":"GHSA-cjvr-mfj7-j4j8","id":"tcs_01M5KFD8WWAXKD4DQ4ZTDPSZA7","modified_at":"2026-09-24T15:00:05.276642539Z","published_at":"2022-03-01T22:12:47Z","references":["https://osv.dev/vulnerability/GHSA-cjvr-mfj7-j4j8","https://github.com/scrapy/scrapy/security/advisories/GHSA-cjvr-mfj7-j4j8","https://nvd.nist.gov/vuln/detail/CVE-2022-0577","https://github.com/scrapy/scrapy/commit/8ce01b3b76d4634f55067d6cfdf632ec70ba304a","https://github.com/pypa/advisory-database/tree/main/vulns/scrapy/PYSEC-2022-159.yaml","https://github.com/scrapy/scrapy","https://huntr.dev/bounties/3da527b1-2348-4f69-9e88-2e11a96ac585","https://lists.debian.org/debian-lts-announce/2022/03/msg00021.html"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-cjvr-mfj7-j4j8","url":"https://osv.dev/vulnerability/GHSA-cjvr-mfj7-j4j8"}],"summary":"Incorrect Authorization and Exposure of Sensitive Information to an Unauthorized Actor in scrapy"}