EUVD-2026-88566
GHSA-67v2-cr69-p4wm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessControl a URL recorded by httpdbg
-
DeliveryInject javascript: scheme into recorded request
-
ExploitLink rendered clickable in web UI
-
ExecutionDeveloper clicks the link
-
PersistScript executes in app origin
-
ImpactExfiltrate captured headers and tokens
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Two conditions must both hold: (1) the attacker must control or influence a URL that httpdbg records in its captured traffic so a javascript: scheme URL is stored, and (2) a user with access to the httpdbg web interface must click that rendered link (UI:P). It affects httpdbg before 2.2.1, where index.htm renders recorded URLs directly as |
| Impact | This is a genuine but low-to-moderate priority stored XSS (CWE-79) in a niche developer tool. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N, score 5.3) is consistent with the description: network reachable, low complexity, no privileges, but requires user interaction (a click) and yields only limited confidentiality/integrity impact. There is no EPSS score, no CISA KEV listing, and no public exploit code identified in the provided data, so exploitation is theoretical at this time. The dominant limiting factors are twofold and both required: an attacker must first control a URL that ends up in httpdbg's recorded traffic, AND a developer must then click the malicious link inside httpdbg's web UI. No signals conflict here - every source (VulnCheck advisory, GitHub issue #220, PR #222 patch) points to a straightforward, patched client-side XSS. The reason this is not a top priority despite AV:N/PR:N is the narrow trigger chain plus the product's small, developer-only footprint, not any signal contradiction. |
| Exploit ScenarioDerived | A developer uses httpdbg to trace HTTP traffic from an application that fetches an attacker-influenced URL; the attacker arranges for that recorded request URL to use a javascript: scheme instead of http/https. When the developer later reviews the capture in httpdbg's web interface and clicks the rendered link, the script executes in the httpdbg origin and exfiltrates captured request/response data, including headers and authentication tokens. No public exploit code is identified, and exploitation requires the victim to click the crafted link (UI:P). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Stored cross-site scripting (XSS) in httpdbg before 2.2.1 allows an attacker who controls or influences a URL captured by the tool to inject a javascript: scheme link that executes script in the application origin when a user clicks it (CVSS:4.0 5.3, UI:P, PR:N, so unauthenticated but requiring user interaction). Successful exploitation exposes the recorded request and response data httpdbg displays - including headers and captured tokens - because the malicious script runs in the origin of the local debugging web interface. The issue is not reported as actively exploited and no public exploit code has been identified at time of analysis, and the practical exposure is narrowed by httpdbg's use as a developer-facing, typically local debugging tool that a victim must open and interact with; vendor-released patch: 2.2.1.
RemediationAI
Upgrade to httpdbg 2.2.1 or later (vendor-released patch: 2.2.1), which validates URL schemes in render.js and only allows http:/https: to render as clickable links, presenting non-HTTP(S) URLs as plain, non-clickable text with a warning, per PR https://github.com/cle-b/httpdbg/pull/222, commit https://github.com/cle-b/httpdbg/commit/121845b41c19ddaf30b51be0797bc2ff4847d8b3 and release https://github.com/cle-b/httpdbg/releases/tag/v2.2.1. If immediate upgrade is not possible, compensating controls include: bind the httpdbg web interface to localhost only and do not expose it to other hosts or networks (trade-off: it becomes unusable for remote/shared capture review); treat all captured traffic as untrusted input and avoid clicking recorded URLs in the UI, especially from traffic the operator did not generate (trade-off: manual copy/paste of URLs is required); keep recording sessions limited to trusted applications and endpoints; and clear or avoid persisting capture sessions that contain externally influenced URLs, since the injected link only executes when a user opens and clicks it in the interface. Note the fix's target="_blank" behavior and the removed raw anchor are intentional hardening changes, and there is no vendor-released patch identified for versions before 2.2.1 other than upgrading.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a stored/persistent XSS (CWE-79, improper neutralization of input during web page generation) rooted in missing URL scheme validation. The httpdbg web interface template index.htm (line ~302 in v2.2.0) rendered each recorded request as a raw anchor, <a href="{{ url }}">{{ url }}</a>, and the capture hook recordhttp2.py fed the recorded request URL into that template without restricting its scheme. Because the href attribute is emitted verbatim, a recorded URL beginning with javascript: becomes an executable link; clicking it runs attacker-controlled script in the origin of the httpdbg webapp, which is the same origin that holds the captured HTTP session data (headers, cookies, authorization tokens). Note the template stack (Mustache-style sections such as {{#is_http}}) and render.js, which builds the request view model. The upstream fix (commit 121845b, PR #222, released as 2.2.1) adds client-side parsing in render.js that accepts only http: and https: schemes, and in index.htm renders non-HTTP(S) URLs as inert span text with a security warning instead of a clickable anchor, alongside a copy-to-clipboard button. CPE cpe:2.3:a:cle-b:httpdbg:*:*:*:*:*:*:*:* denotes all versions prior to the fixed release.
Know when Httpdbg gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Stored XSS reachable without auth (PR:N) but needs victim click (UI:R); script escapes into the app origin (S:C) with limited data theft/tampering (C:L/I:L), no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web interface. Attackers controlling traffic recorded by httpdbg can supply javascript: scheme URLs that execute malicious scripts in the application origin when clicked, allowing access to captured request and response data including headers and tokens.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB