{"cve":"CVE-2019-10751","nvd":{"published":"2019-08-23T17:15:13.543","modified":"2026-06-17T02:11:36.103","status":"Modified","description":"All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-601"],"references":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00003.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00022.html","https://github.com/jakubroztocil/httpie/releases/tag/1.0.3","https://lists.debian.org/debian-lts-announce/2019/09/msg00031.html","https://snyk.io/vuln/SNYK-PYTHON-HTTPIE-460107"],"products":["httpie:httpie"],"source":"nvd","synced_at":"2026-10-19T20:58:39.700375520+00:00"},"epss":{"cve":"CVE-2019-10751","score":0.02037,"percentile":0.81102,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-xjjg-vmw6-c2p9","url":"https://osv.dev/vulnerability/GHSA-xjjg-vmw6-c2p9","summary":"Open Redirect in httpie","modified":"2026-09-10T03:48:44.436762468Z","packages":[{"ecosystem":"PyPI","name":"httpie","purl":"pkg:pypi/httpie","ranges":["<1.0.3"],"fixed":["1.0.3"]}]},{"id":"PYSEC-2019-23","url":"https://osv.dev/vulnerability/PYSEC-2019-23","summary":"","modified":"2023-11-08T04:00:54.897717Z","packages":[{"ecosystem":"PyPI","name":"httpie","purl":"pkg:pypi/httpie","ranges":["<1.0.3"],"fixed":["1.0.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}