Since Scrapy 1.4.0, the RefererMiddleware respects the Referrer-Policy response header to determine how to set the Referer header on follow-up requests. However, if the Referrer-Policy header contains a string that looks like a Python import path, Scrapy attempts to import and instantiate the referenced object as a referrer policy class. This behavior allows an attacker controlling the Referrer-Policy header to cause arbitrary module import and execution, for example by setting it to 'sys.exit' to terminate the process. This vulnerability affects Scrapy versions >=2.9.0 and <2.14.2. The issue is fixed in Scrapy 2.14.2.

An attacker controlling the Referrer-Policy header can cause Scrapy to import and execute arbitrary Python modules, potentially terminating the process or causing other unintended behavior. This results in a denial of service impact (availability). There is no indication of confidentiality or integrity impact. No known exploits in the wild have been reported.

Upgrade to Scrapy version 2.14.2 or later, where this vulnerability is fixed. If upgrading is not possible, mitigate by disabling the RefererMiddleware (set REFERER_ENABLED to False) or manually setting the Referer header on requests. Alternatively, set the 'referrer_policy' request meta key to a safe value to prevent evaluating untrusted Referrer-Policy headers. Another option is to disable the built-in middleware and replace it with the patched implementation from Scrapy 2.14.2 or backport the patch to your version. Follow the vendor's advisory for detailed mitigation steps.