CVE-2026-102333
httpdbg before 2.2.1 Stored Cross-Site Scripting via javascript URL
cle-b httpdbg
CVSS
5.3MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 29 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.2.1httpdbgCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web interface. Attackers controlling traffic recorded by httpdbg can supply javascript: scheme URLs that execute malicious scripts in the application origin when clicked, allowing access to captured request and response data including headers and tokens.
Text from CVE List
Affected versions 1
- httpdbgaffected: all versions before 2.2.1CVE List
References 8
- github.com/cle-b/httpdbg/pull/222Fixvia CVE List
- github.com/cle-b/httpdbg/commit/121845b41c19ddaf30b51be0797bc2ff4847d8b3Fixvia CVE List
- github.com/cle-b/httpdbg/releases/tag/v2.2.1Fixvia CVE List
- vulncheck.com/advisories/httpdbg-before-2.2.1-stored-cross-site-scripting-via-javascript-urlAdvisoryvia CVE List
- github.com/cle-b/httpdbg/issues/220Exploitvia CVE List
- github.com/cle-b/httpdbg/blob/v2.2.0/httpdbg/webapp/static/index.htm#L302Referencevia CVE List
- github.com/cle-b/httpdbg/blob/v2.2.0/httpdbg/hooks/recordhttp2.py#L88-L97Referencevia CVE List
- github.com/cle-b/httpdbgReferencevia CVE List