CVE-2019-10751: Open Redirect Vulnerability in httpie
Summary
CVE-2019-10751: All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a r... Affects httpie versions < 1.0.3. Fixed in 1.0.3. How to fix ↓
Also tracked for
- httpie · Debian:11
The same CVE-2019-10751 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HTTPie is a command-line tool for making HTTP requests. It provides a simple and intuitive interface for interacting with HTTP servers. The vulnerability in HTTPie versions prior to 1.0.3 allows an attacker to perform an open redirect, enabling them to write an arbitrary file with a supplied filename and content to the current directory. This can be achieved by redirecting a request from HTTP to a crafted URL controlled by the attacker.
Vulnerability Detail
The open redirect vulnerability in HTTPie can be exploited by an attacker to write arbitrary files to the current directory. By redirecting a request from HTTP to a specially crafted URL under their control, the attacker can specify the filename and content of the file to be written. This can lead to various malicious activities, such as overwriting important files or executing arbitrary code by tricking users into executing the crafted URL.
How To Fix
Latest published version: 3.2.4 as of 22 Oct 2026
pip install --upgrade "httpie==3.2.4"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.3
This is the first release that contains the fix.
pip install --upgrade "httpie==1.0.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to upgrade to the fixed version of the HTTPie package.
Conclusion
The open redirect vulnerability in HTTPie versions prior to 1.0.3 allows an attacker to write arbitrary files to the current directory. To mitigate this vulnerability, it is crucial to upgrade to version 1.0.3 or later of the HTTPie package. For additional support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for httpie →
FAQ
This vulnerability allows an attacker to write arbitrary files to the current directory, potentially leading to the overwrite of important files or execution of arbitrary code.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply enter your Pipfile.lock and it will provide real-time alerts for open-source vulnerabilities, including this one.
While there is no known public exploit for this vulnerability at the moment, it is still important to upgrade to the fixed version to prevent any potential exploitation.
The only effective mitigation for this vulnerability is to upgrade to version 1.0.3 or later of the HTTPie package.
For further support on vulnerability remediation, you can contact info@devnack.com.
Related vulnerabilities
Recent vulnerabilities recorded for httpie.
