Skip to content
OpenAdvisories

Package · crates.io

hurl

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 6.9
    CVE-2026-63481

    Hurl: Cookies in Cookies section leak when redirecting to a different host

    Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redire…

    Orange-OpenSource hurl hurl rust-hurl Debian Ubuntu Wolfi crates.io
  • Medium —
    GHSA-v33j-v3x4-42qg

    Regex literal in Hurl files are not escaped when exported to HTML, allowing injections

    Given this Hurl file: regex.hurl: ``` GET https://foo.com HTTP 200 [Asserts] jsonpath "$.body" matches /<img src="" onerror="alert('Hi!')">/ ``` When exported to HTML: ``` $ hurlfmt --out html regex.hurl <pre><code class="language-hurl"><span class="hurl-entr…

    hurl crates.io