Read the docs
TI-2019-08016 Aliases CVE-2019-10751GHSA-xjjg-vmw6-c2p9

Open redirect in HTTPIE

Priority MEDIUM 42CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.

Why it matters now

EPSS 0.02037 81st percentileScored 2026-11-07
Fix Fixed httpie (PyPI): 1.0.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—HTTPIEAll versions prior to version 1.0.3—No fix listedCNA
—httpie (PyPI)before 1.0.31.0.3Patch availableGHSA-xjjg-vmw6-c2p9
  • HTTPIE Vendor— Affected All versions prior to version 1.0.3 Fixed in — No fix listed CNA
  • httpie (PyPI) Vendor— Affected before 1.0.3 Fixed in 1.0.3 Patch available GHSA-xjjg-vmw6-c2p9

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:httpie:httpie:*:*:*:*:*:*:*:*all versionsVulnerablehttpie
  • cpe:2.3:a:httpie:httpie:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·httpie

Remediation

  • Fix · GHSA-xjjg-vmw6-c2p9 httpie (PyPI) Fixed in 1.0.3 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-10751
  2. 2026-10-03 Alias added: GHSA-xjjg-vmw6-c2p9

References

Advisory 5

Other 3

  • TI-2022-08551 Exposure of Sensitive Information to an Unauthorized Actor in httpie CVSS 3.1MEDIUM 6.5
  • TI-2023-26015 Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on… CVSS 3.1HIGH 7.4
  • TI-2022-00354 Exposure of Sensitive Information to an Unauthorized Actor in httpie/httpie CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences