Vulnerability · Published May 28, 2026 · Assigned by GitHub_M
CVE-2026-45348pyLoad: Stored XSS in Downloads view via unsanitized link URL in packages.js template literal
High 8.7
In plain English
A high-severity cross-site scripting in pyload from pyload. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Official description
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the packages.js template at src/pyload/webui/app/themes/modern/templates/js/packages.js:172 interpolates a stored link URL into a template literal inside single-quoted HTML and then writes the result to the DOM via $(div).html(html). No escaping runs between the API value and innerHTML. An attacker (Alice) who can submit a package link puts a single quote plus event handler into the URL, breaks out of the attribute, and executes JavaScript in every operator's browser that opens the downloads view. The theme does not set a Content Security Policy that restricts inline script or event handlers. This vulnerability is fixed in 0.5.0b3.dev100.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | pyload-ng | no fix listed | GHSA-fcjq-435v-jx94 |
| PyPI | pyload-ng | no fix listed | PYSEC-2026-2994 |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
References
- https://github.com/pyload/pyload/security/advisories/GHSA-fcjq-435v-jx94 x_refsource_CONFIRM