CVE-2019-10751
Open Redirect in httpie
All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.
- Record
CVE-2019-10751- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
CVE List No score
All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.
- Record
CVE-2019-10751- Updated
- 2026-11-02
EUVDEUVD-2019-0060 No score
All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.
- Record
EUVD-2019-0060- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xjjg-vmw6-c2p9
Open Redirect in httpie
All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.
- Record
GHSA-xjjg-vmw6-c2p9- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.
- Record
CVE-2019-10751- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-10751
All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.
- Record
DEBIAN-CVE-2019-10751- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVGHSA-xjjg-vmw6-c2p9
Open Redirect in httpie
All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.
- Record
GHSA-xjjg-vmw6-c2p9- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-10751
All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.
- Record
UBUNTU-CVE-2019-10751- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2019-0351 No score
Updated httpie packages fix security vulnerability
Updated httpie packages fix security vulnerability:
HTTPie is vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or her control (CVE-2019-10751).
- Record
MGASA-2019-0351- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2050-1 No score
Security update for httpie
This update for httpie fixes the following issues:
httpie was updated to version 1.0.3:
- Fix CVE-2019-10751 (HTTPie is volnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control. (bsc#1148466)
- Record
openSUSE-SU-2019:2050-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2089-1 No score
Security update for httpie
This update for httpie fixes the following issues:
httpie was updated to version 1.0.3:
- Fix CVE-2019-10751 (HTTPie is vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control. (bsc#1148466)
This update was imported from the openSUSE:Leap:15.1:Update update project.
- Record
openSUSE-SU-2019:2089-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10849-1 No score
httpie-2.5.0-1.2 on GA media
These are all security issues fixed in the httpie-2.5.0-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10849-1- Updated
- 2026-11-02
OSVPYSEC-2019-23 No score
All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.
- Record
PYSEC-2019-23- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
httpiePyPI |
before 1.0.3 | 1.0.3 |
httpieDebian:12 |
before 1.0.3-1 | 1.0.3-1 |
httpieDebian:13 |
before 1.0.3-1 | 1.0.3-1 |
httpieDebian:14 |
before 1.0.3-1 | 1.0.3-1 |
httpieDebian:8 |
before 0.8.0-1+deb8u1, plus listed versions 0.8.0-1 |
0.8.0-1+deb8u1 |
httpiePyPI |
before 1.0.3, plus listed versions 0.10.1.10.1.20.1.30.1.4 Show 33 moreShow less0.1.50.1.60.2.00.2.10.2.20.2.30.2.40.2.4dev0.2.50.2.60.2.70.3.00.3.10.4.00.4.10.5.00.5.10.6.00.7.00.7.20.8.00.9.00.9.10.9.20.9.30.9.40.9.50.9.60.9.70.9.80.9.91.0.01.0.2 |
1.0.3 |
httpieMageia:7 |
before 1.0.3-1.mga7 | 1.0.3-1.mga7 |
httpiePyPI |
before 1.0.3, plus listed versions 0.10.1.10.1.20.1.30.1.4 Show 33 moreShow less0.1.50.1.60.2.00.2.10.2.20.2.30.2.4dev0.2.40.2.50.2.60.2.70.3.00.3.10.4.00.4.10.5.00.5.10.6.00.7.00.7.20.8.00.9.00.9.10.9.20.9.30.9.40.9.50.9.60.9.70.9.80.9.91.0.01.0.2 |
1.0.3 |
httpieUbuntu:Pro:14.04:LTS |
before 0.8.0-1+deb8u1build0.14.04.1~esm1, plus listed versions 0.3.1-10.7.1-0.10.8.0-1 |
0.8.0-1+deb8u1build0.14.04.1~esm1 |
httpieUbuntu:16.04:LTS |
All versions, plus listed versions 0.9.2-0.10.9.2-1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
httpieUbuntu:18.04:LTS |
All versions, plus listed versions 0.9.8-2 |
None known |
httpieSUSE:Package Hub 15 SP1 |
before 1.0.3-bp151.2.3.1 | 1.0.3-bp151.2.3.1 |
httpieopenSUSE:Leap 15.1 |
before 1.0.3-bp151.2.3.1 | 1.0.3-bp151.2.3.1 |
httpieSUSE:Package Hub 15 SP1 |
before 1.0.3-bp151.2.6.1 | 1.0.3-bp151.2.6.1 |
httpieopenSUSE:Tumbleweed |
before 2.5.0-1.2 | 2.5.0-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-10751 is a high vulnerability (CVSS 8.8) in Httpie, published August 23, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.04%, the 81st percentile. Fixed in httpie 1.0.3.
References
snyk.io/vuln/SNYK-PYTHON-HTTPIE-460107
github.com/jakubroztocil/httpie/releases/tag/1.0.3
lists.opensuse.org/opensuse-security-announce/2019-09/msg00003.html
lists.debian.org/debian-lts-announce/2019/09/msg00031.html
nvd.nist.gov/vuln/detail/CVE-2019-10751
Show 13 moreShow less
security-tracker.debian.org/tracker/CVE-2019-10751
advisories.mageia.org/MGASA-2019-0351.html
bugs.mageia.org/show_bug.cgi?id=25764
ubuntu.com/security/CVE-2019-10751
cve.org/CVERecord?id=CVE-2019-10751
bugzilla.suse.com/1148466
suse.com/security/cve/CVE-2019-10751