CVE-2026-102333
httpdbg before 2.2.1 Stored Cross-Site Scripting via javascript URL
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web interface. Attackers controlling traffic recorded by httpdbg can supply javascript: scheme URLs that execute malicious scripts in the application origin when clicked, allowing access to captured request and response data including headers and tokens.
| CWE | CWE-79 |
| Vendor | cle-b |
| Product | httpdbg |
| Published | Sep 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for cle-b httpdbg
Be the first to know when new medium vulnerabilities affecting cle-b httpdbg are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
cle-b / httpdbg
0 < 2.2.1
References
github.com: https://github.com/cle-b/httpdbg/issues/220 github.com: https://github.com/cle-b/httpdbg/pull/222 github.com: https://github.com/cle-b/httpdbg/commit/121845b41c19ddaf30b51be0797bc2ff4847d8b3 github.com: https://github.com/cle-b/httpdbg/releases/tag/v2.2.1 github.com: https://github.com/cle-b/httpdbg/blob/v2.2.0/httpdbg/webapp/static/index.htm#L302 github.com: https://github.com/cle-b/httpdbg/blob/v2.2.0/httpdbg/hooks/recordhttp2.py#L88-L97 github.com: https://github.com/cle-b/httpdbg vulncheck.com: https://www.vulncheck.com/advisories/httpdbg-before-2.2.1-stored-cross-site-scripting-via-javascript-url
Credits
M.J Dhurgesh