A flaw was found in httpdbg. The application fails to validate URL schemes in recorded HTTP request URLs before rendering them as clickable links in the web interface. An attacker who controls traffic recorded by httpdbg can supply a link containing malicious scripts, leading to stored Cross-Site Scripting (XSS). When a user clicks the link in the web console, the script executes within their browser session, potentially allowing the attacker to access captured request and response data, including sensitive headers and authentication tokens.
Last checked: 2026-09-30 19:21 UTC
Proof of concept · CISA Coordinator (Assessed 2026-09-29 12:35 UTC)
Fix evidence last checked: 2026-09-29 04:56 UTC