hurl
Activity
- Latest release
- 4mo ago
- Total releases
- 26
- Cadence
- ~3 months
- Last 12 months
- 3
Details
- License
- Apache-2.0
- First release
- Mar 03, 2021
| Version | Released | |
|---|---|---|
8.0.1
unknown
1 CVE
CVE-2026-63481
GHSA-7w2g-9mf9-324m
Sep 02, 2026
Hurl: Cookies in Cookies section leak when redirecting to a different host
Medium
Network
Low
None
The BugHurl <= 8.0.1 lets you define cookies two ways in a .hurl file:
When following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in as a header. Cookies declared in the [Cookies] section were carried over to the new host unchanged — a credential-leak bug. Hurl file that leaks cookies: Hurl file that doesn't leak cookie: PatchWith Hurl <= 8.0.1, user can use References
Updated Sep 02, 2026 · Source: OSV.dev |
8.0.1
unknown
Dependencies (24)
+ 16 more |
|
8.0.0
unknown
1 CVE
CVE-2026-63481
GHSA-7w2g-9mf9-324m
Sep 02, 2026
Hurl: Cookies in Cookies section leak when redirecting to a different host
Medium
Network
Low
None
The BugHurl <= 8.0.1 lets you define cookies two ways in a .hurl file:
When following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in as a header. Cookies declared in the [Cookies] section were carried over to the new host unchanged — a credential-leak bug. Hurl file that leaks cookies: Hurl file that doesn't leak cookie: PatchWith Hurl <= 8.0.1, user can use References
Updated Sep 02, 2026 · Source: OSV.dev |
8.0.0
unknown
Dependencies (24)
+ 16 more |
|
7.1.0
unknown
1 CVE
CVE-2026-63481
GHSA-7w2g-9mf9-324m
Sep 02, 2026
Hurl: Cookies in Cookies section leak when redirecting to a different host
Medium
Network
Low
None
The BugHurl <= 8.0.1 lets you define cookies two ways in a .hurl file:
When following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in as a header. Cookies declared in the [Cookies] section were carried over to the new host unchanged — a credential-leak bug. Hurl file that leaks cookies: Hurl file that doesn't leak cookie: PatchWith Hurl <= 8.0.1, user can use References
Updated Sep 02, 2026 · Source: OSV.dev |
7.1.0
unknown
Dependencies (25)
+ 17 more |
|
7.0.0
unknown
1 CVE
CVE-2026-63481
GHSA-7w2g-9mf9-324m
Sep 02, 2026
Hurl: Cookies in Cookies section leak when redirecting to a different host
Medium
Network
Low
None
The BugHurl <= 8.0.1 lets you define cookies two ways in a .hurl file:
When following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in as a header. Cookies declared in the [Cookies] section were carried over to the new host unchanged — a credential-leak bug. Hurl file that leaks cookies: Hurl file that doesn't leak cookie: PatchWith Hurl <= 8.0.1, user can use References
Updated Sep 02, 2026 · Source: OSV.dev |
7.0.0
unknown
Dependencies (25)
+ 17 more |
|
6.1.1
unknown
2 CVEs
CVE-2026-63481
GHSA-7w2g-9mf9-324m
Sep 02, 2026
Hurl: Cookies in Cookies section leak when redirecting to a different host
Medium
Network
Low
None
The BugHurl <= 8.0.1 lets you define cookies two ways in a .hurl file:
When following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in as a header. Cookies declared in the [Cookies] section were carried over to the new host unchanged — a credential-leak bug. Hurl file that leaks cookies: Hurl file that doesn't leak cookie: PatchWith Hurl <= 8.0.1, user can use References
Updated Sep 02, 2026 · Source: OSV.dev
GHSA-v33j-v3x4-42qg
Jun 11, 2025
Regex literal in Hurl files are not escaped when exported to HTML, allowing injections
Medium
Given this Hurl file: regex.hurl: When exported to HTML: The regex literal
When opened in a browser, the code is run without user interaction: Fixed in
7.0.0
References
Updated Jun 11, 2025 · Source: OSV.dev |
6.1.1
unknown
Dependencies (27)
+ 19 more |
|
6.1.0
unknown
2 CVEs
CVE-2026-63481
GHSA-7w2g-9mf9-324m
Sep 02, 2026
Hurl: Cookies in Cookies section leak when redirecting to a different host
Medium
Network
Low
None
The BugHurl <= 8.0.1 lets you define cookies two ways in a .hurl file:
When following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in as a header. Cookies declared in the [Cookies] section were carried over to the new host unchanged — a credential-leak bug. Hurl file that leaks cookies: Hurl file that doesn't leak cookie: PatchWith Hurl <= 8.0.1, user can use References
Updated Sep 02, 2026 · Source: OSV.dev
GHSA-v33j-v3x4-42qg
Jun 11, 2025
Regex literal in Hurl files are not escaped when exported to HTML, allowing injections
Medium
Given this Hurl file: regex.hurl: When exported to HTML: The regex literal
When opened in a browser, the code is run without user interaction: Fixed in
7.0.0
References
Updated Jun 11, 2025 · Source: OSV.dev |
6.1.0
unknown
Dependencies (27)
+ 19 more |
|
6.0.0
unknown
2 CVEs
CVE-2026-63481
GHSA-7w2g-9mf9-324m
Sep 02, 2026
Hurl: Cookies in Cookies section leak when redirecting to a different host
Medium
Network
Low
None
The BugHurl <= 8.0.1 lets you define cookies two ways in a .hurl file:
When following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in as a header. Cookies declared in the [Cookies] section were carried over to the new host unchanged — a credential-leak bug. Hurl file that leaks cookies: Hurl file that doesn't leak cookie: PatchWith Hurl <= 8.0.1, user can use References
Updated Sep 02, 2026 · Source: OSV.dev
GHSA-v33j-v3x4-42qg
Jun 11, 2025
Regex literal in Hurl files are not escaped when exported to HTML, allowing injections
Medium
Given this Hurl file: regex.hurl: When exported to HTML: The regex literal
When opened in a browser, the code is run without user interaction: Fixed in
7.0.0
References
Updated Jun 11, 2025 · Source: OSV.dev |
6.0.0
unknown
Dependencies (28)
+ 20 more |
|
5.0.1
unknown
2 CVEs
CVE-2026-63481
GHSA-7w2g-9mf9-324m
Sep 02, 2026
Hurl: Cookies in Cookies section leak when redirecting to a different host
Medium
Network
Low
None
The BugHurl <= 8.0.1 lets you define cookies two ways in a .hurl file:
When following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in as a header. Cookies declared in the [Cookies] section were carried over to the new host unchanged — a credential-leak bug. Hurl file that leaks cookies: Hurl file that doesn't leak cookie: PatchWith Hurl <= 8.0.1, user can use References
Updated Sep 02, 2026 · Source: OSV.dev
GHSA-v33j-v3x4-42qg
Jun 11, 2025
Regex literal in Hurl files are not escaped when exported to HTML, allowing injections
Medium
Given this Hurl file: regex.hurl: When exported to HTML: The regex literal
When opened in a browser, the code is run without user interaction: Fixed in
7.0.0
References
Updated Jun 11, 2025 · Source: OSV.dev |
5.0.1
unknown
Dependencies (29)
+ 21 more |
|
5.0.0
unknown
2 CVEs
CVE-2026-63481
GHSA-7w2g-9mf9-324m
Sep 02, 2026
Hurl: Cookies in Cookies section leak when redirecting to a different host
Medium
Network
Low
None
The BugHurl <= 8.0.1 lets you define cookies two ways in a .hurl file:
When following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in as a header. Cookies declared in the [Cookies] section were carried over to the new host unchanged — a credential-leak bug. Hurl file that leaks cookies: Hurl file that doesn't leak cookie: PatchWith Hurl <= 8.0.1, user can use References
Updated Sep 02, 2026 · Source: OSV.dev
GHSA-v33j-v3x4-42qg
Jun 11, 2025
Regex literal in Hurl files are not escaped when exported to HTML, allowing injections
Medium
Given this Hurl file: regex.hurl: When exported to HTML: The regex literal
When opened in a browser, the code is run without user interaction: Fixed in
7.0.0
References
Updated Jun 11, 2025 · Source: OSV.dev |
5.0.0
unknown
Dependencies (29)
+ 21 more |
|
4.3.0
unknown
2 CVEs
CVE-2026-63481
GHSA-7w2g-9mf9-324m
Sep 02, 2026
Hurl: Cookies in Cookies section leak when redirecting to a different host
Medium
Network
Low
None
The BugHurl <= 8.0.1 lets you define cookies two ways in a .hurl file:
When following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in as a header. Cookies declared in the [Cookies] section were carried over to the new host unchanged — a credential-leak bug. Hurl file that leaks cookies: Hurl file that doesn't leak cookie: PatchWith Hurl <= 8.0.1, user can use References
Updated Sep 02, 2026 · Source: OSV.dev
GHSA-v33j-v3x4-42qg
Jun 11, 2025
Regex literal in Hurl files are not escaped when exported to HTML, allowing injections
Medium
Given this Hurl file: regex.hurl: When exported to HTML: The regex literal
When opened in a browser, the code is run without user interaction: Fixed in
7.0.0
References
Updated Jun 11, 2025 · Source: OSV.dev |
4.3.0
unknown
Dependencies (28)
+ 20 more |
|
4.2.0
unknown
2 CVEs
CVE-2026-63481
GHSA-7w2g-9mf9-324m
Sep 02, 2026
Hurl: Cookies in Cookies section leak when redirecting to a different host
Medium
Network
Low
None
The BugHurl <= 8.0.1 lets you define cookies two ways in a .hurl file:
When following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in as a header. Cookies declared in the [Cookies] section were carried over to the new host unchanged — a credential-leak bug. Hurl file that leaks cookies: Hurl file that doesn't leak cookie: PatchWith Hurl <= 8.0.1, user can use References
Updated Sep 02, 2026 · Source: OSV.dev
GHSA-v33j-v3x4-42qg
Jun 11, 2025
Regex literal in Hurl files are not escaped when exported to HTML, allowing injections
Medium
Given this Hurl file: regex.hurl: When exported to HTML: The regex literal
When opened in a browser, the code is run without user interaction: Fixed in
7.0.0
References
Updated Jun 11, 2025 · Source: OSV.dev |
4.2.0
unknown
Dependencies (28)
+ 20 more |
|
4.1.0
unknown
2 CVEs
CVE-2026-63481
GHSA-7w2g-9mf9-324m
Sep 02, 2026
Hurl: Cookies in Cookies section leak when redirecting to a different host
Medium
Network
Low
None
The BugHurl <= 8.0.1 lets you define cookies two ways in a .hurl file:
When following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in as a header. Cookies declared in the [Cookies] section were carried over to the new host unchanged — a credential-leak bug. Hurl file that leaks cookies: Hurl file that doesn't leak cookie: PatchWith Hurl <= 8.0.1, user can use References
Updated Sep 02, 2026 · Source: OSV.dev
GHSA-v33j-v3x4-42qg
Jun 11, 2025
Regex literal in Hurl files are not escaped when exported to HTML, allowing injections
Medium
Given this Hurl file: regex.hurl: When exported to HTML: The regex literal
When opened in a browser, the code is run without user interaction: Fixed in
7.0.0
References
Updated Jun 11, 2025 · Source: OSV.dev |
4.1.0
unknown
Dependencies (29)
+ 21 more |
|
4.0.0
unknown
2 CVEs
CVE-2026-63481
GHSA-7w2g-9mf9-324m
Sep 02, 2026
Hurl: Cookies in Cookies section leak when redirecting to a different host
Medium
Network
Low
None
The BugHurl <= 8.0.1 lets you define cookies two ways in a .hurl file:
When following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in as a header. Cookies declared in the [Cookies] section were carried over to the new host unchanged — a credential-leak bug. Hurl file that leaks cookies: Hurl file that doesn't leak cookie: PatchWith Hurl <= 8.0.1, user can use References
Updated Sep 02, 2026 · Source: OSV.dev
GHSA-v33j-v3x4-42qg
Jun 11, 2025
Regex literal in Hurl files are not escaped when exported to HTML, allowing injections
Medium
Given this Hurl file: regex.hurl: When exported to HTML: The regex literal
When opened in a browser, the code is run without user interaction: Fixed in
7.0.0
References
Updated Jun 11, 2025 · Source: OSV.dev |
4.0.0
unknown
Dependencies (30)
+ 22 more |
|
3.0.1
unknown
2 CVEs
CVE-2026-63481
GHSA-7w2g-9mf9-324m
Sep 02, 2026
Hurl: Cookies in Cookies section leak when redirecting to a different host
Medium
Network
Low
None
The BugHurl <= 8.0.1 lets you define cookies two ways in a .hurl file:
When following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in as a header. Cookies declared in the [Cookies] section were carried over to the new host unchanged — a credential-leak bug. Hurl file that leaks cookies: Hurl file that doesn't leak cookie: PatchWith Hurl <= 8.0.1, user can use References
Updated Sep 02, 2026 · Source: OSV.dev
GHSA-v33j-v3x4-42qg
Jun 11, 2025
Regex literal in Hurl files are not escaped when exported to HTML, allowing injections
Medium
Given this Hurl file: regex.hurl: When exported to HTML: The regex literal
When opened in a browser, the code is run without user interaction: Fixed in
7.0.0
References
Updated Jun 11, 2025 · Source: OSV.dev |
3.0.1
unknown
Dependencies (30)
+ 22 more |
|
3.0.0
unknown
2 CVEs
CVE-2026-63481
GHSA-7w2g-9mf9-324m
Sep 02, 2026
Hurl: Cookies in Cookies section leak when redirecting to a different host
Medium
Network
Low
None
The BugHurl <= 8.0.1 lets you define cookies two ways in a .hurl file:
When following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in as a header. Cookies declared in the [Cookies] section were carried over to the new host unchanged — a credential-leak bug. Hurl file that leaks cookies: Hurl file that doesn't leak cookie: PatchWith Hurl <= 8.0.1, user can use References
Updated Sep 02, 2026 · Source: OSV.dev
GHSA-v33j-v3x4-42qg
Jun 11, 2025
Regex literal in Hurl files are not escaped when exported to HTML, allowing injections
Medium
Given this Hurl file: regex.hurl: When exported to HTML: The regex literal
When opened in a browser, the code is run without user interaction: Fixed in
7.0.0
References
Updated Jun 11, 2025 · Source: OSV.dev |
3.0.0
unknown
Dependencies (30)
+ 22 more |
|
2.0.1
unknown
2 CVEs
CVE-2026-63481
GHSA-7w2g-9mf9-324m
Sep 02, 2026
Hurl: Cookies in Cookies section leak when redirecting to a different host
Medium
Network
Low
None
The BugHurl <= 8.0.1 lets you define cookies two ways in a .hurl file:
When following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in as a header. Cookies declared in the [Cookies] section were carried over to the new host unchanged — a credential-leak bug. Hurl file that leaks cookies: Hurl file that doesn't leak cookie: PatchWith Hurl <= 8.0.1, user can use References
Updated Sep 02, 2026 · Source: OSV.dev
GHSA-v33j-v3x4-42qg
Jun 11, 2025
Regex literal in Hurl files are not escaped when exported to HTML, allowing injections
Medium
Given this Hurl file: regex.hurl: When exported to HTML: The regex literal
When opened in a browser, the code is run without user interaction: Fixed in
7.0.0
References
Updated Jun 11, 2025 · Source: OSV.dev |
2.0.1
unknown
Dependencies (28)
+ 20 more |
|
2.0.0
unknown
2 CVEs
CVE-2026-63481
GHSA-7w2g-9mf9-324m
Sep 02, 2026
Hurl: Cookies in Cookies section leak when redirecting to a different host
Medium
Network
Low
None
The BugHurl <= 8.0.1 lets you define cookies two ways in a .hurl file:
When following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in as a header. Cookies declared in the [Cookies] section were carried over to the new host unchanged — a credential-leak bug. Hurl file that leaks cookies: Hurl file that doesn't leak cookie: PatchWith Hurl <= 8.0.1, user can use References
Updated Sep 02, 2026 · Source: OSV.dev
GHSA-v33j-v3x4-42qg
Jun 11, 2025
Regex literal in Hurl files are not escaped when exported to HTML, allowing injections
Medium
Given this Hurl file: regex.hurl: When exported to HTML: The regex literal
When opened in a browser, the code is run without user interaction: Fixed in
7.0.0
References
Updated Jun 11, 2025 · Source: OSV.dev |
2.0.0
unknown
Dependencies (28)
+ 20 more |
|
1.8.0
unknown
2 CVEs
CVE-2026-63481
GHSA-7w2g-9mf9-324m
Sep 02, 2026
Hurl: Cookies in Cookies section leak when redirecting to a different host
Medium
Network
Low
None
The BugHurl <= 8.0.1 lets you define cookies two ways in a .hurl file:
When following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in as a header. Cookies declared in the [Cookies] section were carried over to the new host unchanged — a credential-leak bug. Hurl file that leaks cookies: Hurl file that doesn't leak cookie: PatchWith Hurl <= 8.0.1, user can use References
Updated Sep 02, 2026 · Source: OSV.dev
GHSA-v33j-v3x4-42qg
Jun 11, 2025
Regex literal in Hurl files are not escaped when exported to HTML, allowing injections
Medium
Given this Hurl file: regex.hurl: When exported to HTML: The regex literal
When opened in a browser, the code is run without user interaction: Fixed in
7.0.0
References
Updated Jun 11, 2025 · Source: OSV.dev |
1.8.0
unknown
Dependencies (27)
+ 19 more |
|
1.7.0
unknown
2 CVEs
CVE-2026-63481
GHSA-7w2g-9mf9-324m
Sep 02, 2026
Hurl: Cookies in Cookies section leak when redirecting to a different host
Medium
Network
Low
None
The BugHurl <= 8.0.1 lets you define cookies two ways in a .hurl file:
When following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in as a header. Cookies declared in the [Cookies] section were carried over to the new host unchanged — a credential-leak bug. Hurl file that leaks cookies: Hurl file that doesn't leak cookie: PatchWith Hurl <= 8.0.1, user can use References
Updated Sep 02, 2026 · Source: OSV.dev
GHSA-v33j-v3x4-42qg
Jun 11, 2025
Regex literal in Hurl files are not escaped when exported to HTML, allowing injections
Medium
Given this Hurl file: regex.hurl: When exported to HTML: The regex literal
When opened in a browser, the code is run without user interaction: Fixed in
7.0.0
References
Updated Jun 11, 2025 · Source: OSV.dev |
1.7.0
unknown
Dependencies (27)
+ 19 more |
|
1.6.1
unknown
2 CVEs
CVE-2026-63481
GHSA-7w2g-9mf9-324m
Sep 02, 2026
Hurl: Cookies in Cookies section leak when redirecting to a different host
Medium
Network
Low
None
The BugHurl <= 8.0.1 lets you define cookies two ways in a .hurl file:
When following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in as a header. Cookies declared in the [Cookies] section were carried over to the new host unchanged — a credential-leak bug. Hurl file that leaks cookies: Hurl file that doesn't leak cookie: PatchWith Hurl <= 8.0.1, user can use References
Updated Sep 02, 2026 · Source: OSV.dev
GHSA-v33j-v3x4-42qg
Jun 11, 2025
Regex literal in Hurl files are not escaped when exported to HTML, allowing injections
Medium
Given this Hurl file: regex.hurl: When exported to HTML: The regex literal
When opened in a browser, the code is run without user interaction: Fixed in
7.0.0
References
Updated Jun 11, 2025 · Source: OSV.dev |
1.6.1
unknown
Dependencies (27)
+ 19 more |
|
1.6.0
unknown
2 CVEs
CVE-2026-63481
GHSA-7w2g-9mf9-324m
Sep 02, 2026
Hurl: Cookies in Cookies section leak when redirecting to a different host
Medium
Network
Low
None
The BugHurl <= 8.0.1 lets you define cookies two ways in a .hurl file:
When following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in as a header. Cookies declared in the [Cookies] section were carried over to the new host unchanged — a credential-leak bug. Hurl file that leaks cookies: Hurl file that doesn't leak cookie: PatchWith Hurl <= 8.0.1, user can use References
Updated Sep 02, 2026 · Source: OSV.dev
GHSA-v33j-v3x4-42qg
Jun 11, 2025
Regex literal in Hurl files are not escaped when exported to HTML, allowing injections
Medium
Given this Hurl file: regex.hurl: When exported to HTML: The regex literal
When opened in a browser, the code is run without user interaction: Fixed in
7.0.0
References
Updated Jun 11, 2025 · Source: OSV.dev |
1.6.0
unknown
Dependencies (27)
+ 19 more |
|
1.5.0
unknown
2 CVEs
CVE-2026-63481
GHSA-7w2g-9mf9-324m
Sep 02, 2026
Hurl: Cookies in Cookies section leak when redirecting to a different host
Medium
Network
Low
None
The BugHurl <= 8.0.1 lets you define cookies two ways in a .hurl file:
When following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in as a header. Cookies declared in the [Cookies] section were carried over to the new host unchanged — a credential-leak bug. Hurl file that leaks cookies: Hurl file that doesn't leak cookie: PatchWith Hurl <= 8.0.1, user can use References
Updated Sep 02, 2026 · Source: OSV.dev
GHSA-v33j-v3x4-42qg
Jun 11, 2025
Regex literal in Hurl files are not escaped when exported to HTML, allowing injections
Medium
Given this Hurl file: regex.hurl: When exported to HTML: The regex literal
When opened in a browser, the code is run without user interaction: Fixed in
7.0.0
References
Updated Jun 11, 2025 · Source: OSV.dev |
1.5.0
unknown
Dependencies (25)
+ 17 more |
|
1.4.0
unknown
2 CVEs
CVE-2026-63481
GHSA-7w2g-9mf9-324m
Sep 02, 2026
Hurl: Cookies in Cookies section leak when redirecting to a different host
Medium
Network
Low
None
The BugHurl <= 8.0.1 lets you define cookies two ways in a .hurl file:
When following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in as a header. Cookies declared in the [Cookies] section were carried over to the new host unchanged — a credential-leak bug. Hurl file that leaks cookies: Hurl file that doesn't leak cookie: PatchWith Hurl <= 8.0.1, user can use References
Updated Sep 02, 2026 · Source: OSV.dev
GHSA-v33j-v3x4-42qg
Jun 11, 2025
Regex literal in Hurl files are not escaped when exported to HTML, allowing injections
Medium
Given this Hurl file: regex.hurl: When exported to HTML: The regex literal
When opened in a browser, the code is run without user interaction: Fixed in
7.0.0
References
Updated Jun 11, 2025 · Source: OSV.dev |
1.4.0
unknown
Dependencies (23)
+ 15 more |
|
1.3.1
unknown
2 CVEs
CVE-2026-63481
GHSA-7w2g-9mf9-324m
Sep 02, 2026
Hurl: Cookies in Cookies section leak when redirecting to a different host
Medium
Network
Low
None
The BugHurl <= 8.0.1 lets you define cookies two ways in a .hurl file:
When following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in as a header. Cookies declared in the [Cookies] section were carried over to the new host unchanged — a credential-leak bug. Hurl file that leaks cookies: Hurl file that doesn't leak cookie: PatchWith Hurl <= 8.0.1, user can use References
Updated Sep 02, 2026 · Source: OSV.dev
GHSA-v33j-v3x4-42qg
Jun 11, 2025
Regex literal in Hurl files are not escaped when exported to HTML, allowing injections
Medium
Given this Hurl file: regex.hurl: When exported to HTML: The regex literal
When opened in a browser, the code is run without user interaction: Fixed in
7.0.0
References
Updated Jun 11, 2025 · Source: OSV.dev |
1.3.1
unknown
Dependencies (23)
+ 15 more |
|
1.3.0
unknown
2 CVEs
CVE-2026-63481
GHSA-7w2g-9mf9-324m
Sep 02, 2026
Hurl: Cookies in Cookies section leak when redirecting to a different host
Medium
Network
Low
None
The BugHurl <= 8.0.1 lets you define cookies two ways in a .hurl file:
When following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in as a header. Cookies declared in the [Cookies] section were carried over to the new host unchanged — a credential-leak bug. Hurl file that leaks cookies: Hurl file that doesn't leak cookie: PatchWith Hurl <= 8.0.1, user can use References
Updated Sep 02, 2026 · Source: OSV.dev
GHSA-v33j-v3x4-42qg
Jun 11, 2025
Regex literal in Hurl files are not escaped when exported to HTML, allowing injections
Medium
Given this Hurl file: regex.hurl: When exported to HTML: The regex literal
When opened in a browser, the code is run without user interaction: Fixed in
7.0.0
References
Updated Jun 11, 2025 · Source: OSV.dev |
1.3.0
unknown
Dependencies (23)
+ 15 more |
|
1.2.0
unknown
2 CVEs
CVE-2026-63481
GHSA-7w2g-9mf9-324m
Sep 02, 2026
Hurl: Cookies in Cookies section leak when redirecting to a different host
Medium
Network
Low
None
The BugHurl <= 8.0.1 lets you define cookies two ways in a .hurl file:
When following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in as a header. Cookies declared in the [Cookies] section were carried over to the new host unchanged — a credential-leak bug. Hurl file that leaks cookies: Hurl file that doesn't leak cookie: PatchWith Hurl <= 8.0.1, user can use References
Updated Sep 02, 2026 · Source: OSV.dev
GHSA-v33j-v3x4-42qg
Jun 11, 2025
Regex literal in Hurl files are not escaped when exported to HTML, allowing injections
Medium
Given this Hurl file: regex.hurl: When exported to HTML: The regex literal
When opened in a browser, the code is run without user interaction: Fixed in
7.0.0
References
Updated Jun 11, 2025 · Source: OSV.dev |
1.2.0
unknown
Dependencies (17)
+ 9 more |