httpdbg before version 2.2.1 does not validate the scheme of URLs that are rendered as clickable links in the web interface. An attacker who can control the traffic that httpdbg records can insert URLs that use the javascript: scheme. When a user later clicks such a link the script executes within the httpdbg application origin, allowing the attacker to read any data the application can access, such as request and response headers, authentication tokens, and other sensitive information captured by httpdbg.

The vulnerability affects the httpdbg project maintained by cle‑b. Any installation of httpdbg with a version earlier than 2.2.1 is susceptible. The specific version cut‑off is the release of httpdbg 2.2.1, which introduced the fix.

The vulnerability carries a CVSS score of 5.3, indicating moderate severity. EPSS data is not available and the vulnerability is not listed in CISA's KEV catalog, suggesting it is not a widely exploited issue currently. The attack requires an attacker to supply or influence recorded traffic that httpdbg will honor, and then a logged user of the web interface must click the malicious link; this means the threat surface is limited to environments where user interaction with the web UI is possible. Overall, the risk is moderate but should be mitigated promptly, especially in production or shared‑access deployments.