CVE-2024-3572 json
XML External Entity (XXE) Vulnerability in scrapy/scrapy
published 2024-02-16 2 y ago modified 2026-07-07 4 mo ago also GHSA-7j7m-v7m3-jqm7 , PYSEC-2026-1907 , EUVD-2024-0557
- cvss
- 7.5
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 57%
- public exploits
- 0
- none known
Summary
The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This vulnerability allows attackers to perform denial of service attacks, access local files, generate network connections, or circumvent firewalls by submitting specially crafted XML data.
Patch / fix
- pypi scrapy 1.8.4, 2.11.1
- scrapy scrapy/scrapy 2.11.1
- scrapy scrapy 2.11.1
- python-scrapy Debian 14, Debian 13 2.11.1-1
debian advisories DEBIAN-CVE-2024-3572
- python-scrapy Ubuntu Pro 18.04 LTS 1.5.0-1ubuntu0.1~esm1
- python-scrapy Ubuntu Pro 20.04 LTS 1.7.3-1ubuntu0.1~esm1
- python-scrapy Ubuntu Pro 22.04 LTS 2.5.1-2ubuntu0.1~esm1
ubuntu advisories UBUNTU-CVE-2024-3572
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.81% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- huntr.com https://huntr.com/bounties/c4a0fac9-0c5a-4718-9ee4-2d06d58adabb referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | scrapy | >=2.0.0, <2.11.1 <1.8.4 |
2.11.1 1.8.4 |
Affected products
- scrapy scrapy/scrapy
- scrapy scrapy
Classification
- Weakness
-
- CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
References
-
github.com
/scrapy/scrapy/commit/809bfac4890f75fc73607318a04d2ccba71b3d9f
web, patch
-
github.com
/scrapy/scrapy/commit/71b8741e3607cfda2833c7624d4ada87071aa8e5
web
-
huntr.com
/bounties/c4a0fac9-0c5a-4718-9ee4-2d06d58adabb
web, exploit, issue-tracking, third-party-advisory
-
github.com
/scrapy/scrapy/security/advisories/GHSA-7j7m-v7m3-jqm7
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-3572
advisory
-
docs.scrapy.org
/en/latest/news.html#scrapy-2-11-1-2024-02-14
web
-
github.com
/scrapy/scrapy
package
-
pypi.org
/project/scrapy
package
-
github.com
/advisories/GHSA-7j7m-v7m3-jqm7
advisory
Sources
- CVE List CVE-2024-3572
- GitHub Advisory GHSA-7j7m-v7m3-jqm7
- NVD CVE-2024-3572
- OSV PYSEC-2026-1907
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.