Medium severity · published Sep 28, 2026
CVE-2026-102333
httpdbg before 2.2.1 Stored Cross-Site Scripting via javascript URL
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web interface. Attackers controlling traffic recorded by httpdbg can supply javascript: scheme URLs that execute malicious scripts in the application origin when clicked, allowing access to captured request and response data including headers and tokens.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HT
httpdbg · cle-b
before 2.2.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-102333
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-102333
issue-tracking
https://github.com/cle-b/httpdbg/issues/220
patch
https://github.com/cle-b/httpdbg/pull/222
patch
https://github.com/cle-b/httpdbg/commit/121845b41c19ddaf30b51be0797bc2ff4847d8b3
release-notes
https://github.com/cle-b/httpdbg/releases/tag/v2.2.1
technical-description
https://github.com/cle-b/httpdbg/blob/v2.2.0/httpdbg/webapp/static/index.htm#L302
technical-description
https://github.com/cle-b/httpdbg/blob/v2.2.0/httpdbg/hooks/recordhttp2.py#L88-L97