-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| scrapy | pip | < 2.11.1 | 2.11.1 |
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stems from the redirect handling logic in _build_redirect_request function. The commit diff shows this function was modified to add Authorization header removal when domains differ. Before the patch, it only removed Cookie headers during cross-domain redirects but didn't check Authorization headers. The added test_cross_domain_header_dropping in test_downloadermiddleware_redirect.py confirms this was the vulnerable path. The function's responsibility to sanitize headers during redirect creation makes it the clear vulnerability source.