httpdbg before 2.2.1 Stored Cross-Site Scripting via javascript URL

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-102333 · Microsoft / collected KEV context

cve-program · CVE-2026-102333

• https://github.com/cle-b/httpdbg/issues/220
• https://github.com/cle-b/httpdbg/pull/222
• https://github.com/cle-b/httpdbg/commit/121845b41c19ddaf30b51be0797bc2ff4847d8b3
• https://github.com/cle-b/httpdbg/releases/tag/v2.2.1
• https://github.com/cle-b/httpdbg/blob/v2.2.0/httpdbg/webapp/static/index.htm#L302
• https://github.com/cle-b/httpdbg/blob/v2.2.0/httpdbg/hooks/recordhttp2.py#L88-L97
• https://github.com/cle-b/httpdbg
• https://www.vulncheck.com/advisories/httpdbg-before-2.2.1-stored-cross-site-scripting-via-javascript-url

No related operational record is retained in the current change model.