Scrapy versions 2.9.0 up to but not including 2.14.2 have a vulnerability in the RefererMiddleware where the Referrer-Policy response header is improperly handled. If this header contains a value resembling a valid Python import path, Scrapy imports and executes the referenced object. This can be exploited by a malicious site to execute arbitrary code, potentially terminating the process and causing denial of service. A patch is available in Scrapy version 2.14.2.