{"action":"Upgrade scrapy to 1.8.2 or later.","affected":[{"fixed":"1.8.2","introduced":"0"},{"fixed":"2.6.0","introduced":"2.0.0"}],"component":"scrapy","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["1.8.2","2.6.0"],"ghsa_id":"GHSA-mfjm-vh54-3f96","id":"tcs_01M5KFQZ6C5VGV29AWP85D2YCE","modified_at":"2024-12-07T05:40:29.120017Z","published_at":"2022-03-01T22:13:28Z","references":["https://osv.dev/vulnerability/GHSA-mfjm-vh54-3f96","https://github.com/scrapy/scrapy/security/advisories/GHSA-mfjm-vh54-3f96","https://github.com/scrapy/scrapy/commit/e865c4430e58a4faa0e0766b23830f8423d6167a","https://github.com/scrapy/scrapy"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-mfjm-vh54-3f96","url":"https://osv.dev/vulnerability/GHSA-mfjm-vh54-3f96"}],"summary":"Scrapy cookie-setting is not restricted based on the public suffix list"}