CVE-2024-3572 XML External Entity (XXE) Vulnerability in scrapy/scrapy

High 7.5 Published 16 Apr 2024 Updated 1 Aug 2024

Attackers can exploit XML parsing flaws in Scrapy to read local files or cause denial of service via crafted XML input.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2024-3572?

CVE-2024-3572 is a high-severity vulnerability in scrapy/scrapy, published on 16 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This vulnerability allows attackers to perform denial of service attacks, access local files, generate network connections, or circumvent firewalls by submitting specially crafted XML data.

Weakness: CWE-409

Which versions are affected by CVE-2024-3572?

5 open source packages ship an affected version, including scrapy. It affects 1 product.

Package	Affected	Fixed in
`scrapy` PyPI	All versions	`1.8.4, 2.11.1`
`scrapy` PyPI	All versions	`1.8.4`
`scrapy` PyPI	All versions	`1.8.4`
`scrapy` PyPI	From `2.0.0`	`2.11.1`
`scrapy` PyPI	From `2.0.0`	`2.11.1`

Products include Scrapy Scrapy.

How do I fix CVE-2024-3572?

Upgrade scrapy to a fixed version for your release line: 1.8.4 or 2.11.1.

Is CVE-2024-3572 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-3572 exists.

Sources

Also known as DEBIAN-CVE-2024-3572, GHSA-7j7m-v7m3-jqm7, PYSEC-2026-1907, UBUNTU-CVE-2024-3572.