Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

scrapy-splash

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.2PyPIAmendedPublished

    Splash authentication credentials potentially leaked to target websites

    CVE-2021-41124 · GHSA-823f-cwm9-4g74

    Affected
    • PyPI scrapy-splash < 0.8.0
    Fixed in
    0.8.0· Vendor fix available
    Issue
    Impact If you use HttpAuthMiddleware (i.e. the httpuser and httppass spider attributes) for Splash authentication, any non-Splash request will expose your credentials to the request target. This includes robots.txt requests sent by Scrapy when the ROBOTSTXTOBEY setting is set to True. Patches Upgrade to scrapy-splash 0.8.0 and use the new SPLASHUSER and SPLASHPASS settings instead to set your Splash authentication credentials safely. Workarounds If you cannot upgrade, set your Splash request credentials on a per-request basis, using the splashheaders request parameter, instead of defining them globally using the HttpAuthMiddleware. Alternatively, make sure all your requests go through Splash. That includes disabling the robots.txt middleware. For more information If you have any questions or comments about this advisory: Open an issue Email us

    Recommended action: Upgrade to 0.8.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →