PT-2026-79063

Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries...

GHSA-CQ8V-F236-94QC vulnerabilities

Vulnerabilities for packages: uv, kdash, linkerd2-proxy, linkerd-network-validator, deno, lychee, sdp-k8s-injector, hurl, parseable, netavark, cargo-audit, atuin, vector, biome, cargo-c, wasmtime, starship, berg, efs-utils, ntpd-rs, rye, sqlx, mdbook, xh, pixi, zellij, buck2, wasmcloud, zizmor,...

GHSA-CQ8V-F236-94QC vulnerabilities

Vulnerabilities for packages: efs-utils, rav1e, shadowsocks-rust, vector, linkerd2-proxy, wadm, ruff, sentry-cli, py3-xet-core, zed, bootc, asciinema, starship, berg, nushell, hurl, biome, watchexec, kdash, komodo, pixi, zizmor, parseable, wizer, netavark, uv, worktrunk, rye, xh,...

EUVD-2025-18116

Malicious code in bioql PyPI...

GHSA-V33J-V3X4-42QG Regex literal in Hurl files are not escaped when exported to HTML, allowing injections

Given this Hurl file: regex.hurl: GET https://foo.com HTTP 200 Asserts jsonpath "$.body" matches // When exported to HTML: $ hurlfmt --out html regex.hurl GET https://foo.com HTTP 200 Asserts jsonpath "$.body" matches // The regex literal // is not escaped: // When opened in a browser, the code i...

Regex literal in Hurl files are not escaped when exported to HTML, allowing injections

Given this Hurl file: regex.hurl: GET https://foo.com HTTP 200 Asserts jsonpath "$.body" matches // When exported to HTML: $ hurlfmt --out html regex.hurl GET https://foo.com HTTP 200 Asserts jsonpath "$.body" matches // The regex literal // is not escaped: // When opened in a browser, the code i...

PT-2025-26514 · Crates.Io · Hurl

Given this Hurl file: regex.hurl: GET https://foo.com HTTP 200 Asserts jsonpath "$.body" matches // When exported to HTML: $ hurlfmt --out html regex.hurl GET https://foo.com HTTP 200 Asserts jsonpath "$.body" matches // The regex literal // is not escaped: // When opened in a browser, the code i...