What is GHSA-v33j-v3x4-42qg?

Given this Hurl file: regex.hurl: ``` GET https://foo.com HTTP 200 [Asserts] jsonpath "$.body" matches / / ``` When exported to HTML: ``` $ hurlfmt --out html regex.hurl GET https://foo.com HTTP 200 [Asserts]

How severe is GHSA-v33j-v3x4-42qg?

No CVSS score has been assigned to GHSA-v33j-v3x4-42qg yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-v33j-v3x4-42qg?

GHSA-v33j-v3x4-42qg affects the following packages: hurl (crates.io). Ecosystems affected: crates.io.

How do I fix GHSA-v33j-v3x4-42qg?

Update hurl to 7.0.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-v33j-v3x4-42qg is resolved across your whole dependency graph.

How do I detect GHSA-v33j-v3x4-42qg in my crates.io dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for hurl, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-v33j-v3x4-42qg if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Is GHSA-v33j-v3x4-42qg actively exploited in the wild?

No public exploit code has been indexed for GHSA-v33j-v3x4-42qg yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-v33j-v3x4-42qg published, and has it been updated?

GHSA-v33j-v3x4-42qg was published on June 11, 2025. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🦀 crates.io

Not in CISA KEV

Regex literal in Hurl files are not escaped when exported to HTML, allowing injectionsGHSA-v33j-v3x4-42qg

Fix: Orange-OpenSource/hurl@248ac41

GHSA-v33j-v3x4-42qg is a security vulnerability in hurl. A fix is available for hurl — see the affected versions and patch details below.

Published

Jun 11, 2025

Updated

Jun 11, 2025

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Jun 11, 2025 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

🦀hurl

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.

Description

Given this Hurl file:

regex.hurl:

GET https://foo.com
HTTP 200
[Asserts]
jsonpath "$.body" matches /<img src="" onerror="alert('Hi!')">/

When exported to HTML:

$ hurlfmt --out html regex.hurl
<pre><code class="language-hurl"><span class="hurl-entry"><span class="request"><span class="line"><span class="method">GET</span> <span class="url">https://foo.com</span></span>
</span><span class="response"><span class="line"><span class="version">HTTP</span> <span class="number">200</span></span>
<span class="line"><span class="section-header">[Asserts]</span></span>
<span class="line"><span class="query-type">jsonpath</span> <span class="string">"$.body"</span> <span class="predicate-type">matches</span> <span class="regex">/<img src="" onerror="alert('Hi!')">/</span></span>
</span></span><span class="line"></span>
</code></pre>

The regex literal /<img src="" onerror="alert('Hi!')">/ is not escaped:

/<img src="" onerror="alert('Hi!')">/

When opened in a browser, the code is run without user interaction:

regex

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
🦀crates.io	`hurl`	all versions	7.0.0`cargo update -p hurl --precise 7.0.0`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for hurl, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update hurl to 7.0.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-v33j-v3x4-42qg is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

Given this Hurl file: regex.hurl: ``` GET https://foo.com HTTP 200 [Asserts] jsonpath "$.body" matches /<img src="" onerror="alert('Hi!')">/ ``` When exported to HTML: ``` $ hurlfmt --out html regex.hurl <pre><code class="language-hurl">GET https://foo.com HTTP 200 [Asserts]

O3 Security · Impact-Aware SCA

Is GHSA-v33j-v3x4-42qg in your dependencies?

Find it across crates.io, including transitive dependencies.

Scan my dependencies How O3 SCA works