{"action":"Upgrade scrapy to 2.11.1 or later.","affected":[{"fixed":"2.11.1","introduced":"0"}],"component":"scrapy","cve_ids":["CVE-2024-1892"],"ecosystem":"PyPI","epss":0.00557,"exploited":false,"fixed_versions":["2.11.1"],"ghsa_id":"GHSA-cc65-xxvf-f7r9","id":"tcs_01M5KGM6X23VZ8DF3JC54YAQ9V","modified_at":"2026-06-10T17:02:40.004499262Z","published_at":"2024-02-28T00:15:53Z","references":["https://osv.dev/vulnerability/PYSEC-2024-162","https://huntr.com/bounties/271f94f2-1e05-4616-ac43-41752389e26b","https://github.com/scrapy/scrapy/commit/479619b340f197a8f24c5db45bc068fb8755f2c5","https://github.com/advisories/GHSA-cc65-xxvf-f7r9"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"PYSEC-2024-162","url":"https://osv.dev/vulnerability/PYSEC-2024-162"}],"summary":"A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML conte"}