CVE-2025-53890
published 2025-07-15CVE-2025-53890: pyload is an open-source Download Manager written in pure Python. An unsafe JavaScript evaluation vulnerability in pyLoad’s CAPTCHA processing code allows…
PriorityP268critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.14%
62.7th percentile
pyload is an open-source Download Manager written in pure Python. An unsafe JavaScript evaluation vulnerability in pyLoad’s CAPTCHA processing code allows unauthenticated remote attackers to execute arbitrary code in the client browser and potentially the backend server. Exploitation requires no user interaction or authentication and can result in session hijacking, credential theft, and full system remote code execution. Commit 909e5c97885237530d1264cfceb5555870eb9546, the patch for the issue, is included in version 0.5.0b3.dev89.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| pyload-ng_project | pyload-ng | >= 0 < 0.20 | 0.20 |
| pyload | pyload | < 0.5.0b3.dev89 | 0.5.0b3.dev89 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
pyLoad vulnerable to XSS through insecure CAPTCHA
ghsa·2025-07-15
CVE-2025-53890 [CRITICAL] CWE-79 pyLoad vulnerable to XSS through insecure CAPTCHA
pyLoad vulnerable to XSS through insecure CAPTCHA
#### Summary
An unsafe JavaScript evaluation vulnerability in pyLoad’s CAPTCHA processing code allows **unauthenticated remote attackers** to execute **arbitrary code** in the client browser and potentially the backend server. Exploitation requires no user interaction or authentication and can result in session hijacking, credential theft, and full system rce.
#### Details
The vulnerable code resides in
```javascript
function onCaptchaResult(result) {
eval(result); // Direct execution of attacker-controlled input
}
```
* The `onCaptchaResult()` function directly passes CAPTCHA results (sent from the user) into `eval()`
* No sanitization or validation is performed on this input
* A malicious CAPTCHA result can include JavaScript such as
OSV
pyLoad vulnerable to XSS through insecure CAPTCHA
osv·2025-07-15
CVE-2025-53890 [CRITICAL] pyLoad vulnerable to XSS through insecure CAPTCHA
pyLoad vulnerable to XSS through insecure CAPTCHA
#### Summary
An unsafe JavaScript evaluation vulnerability in pyLoad’s CAPTCHA processing code allows **unauthenticated remote attackers** to execute **arbitrary code** in the client browser and potentially the backend server. Exploitation requires no user interaction or authentication and can result in session hijacking, credential theft, and full system rce.
#### Details
The vulnerable code resides in
```javascript
function onCaptchaResult(result) {
eval(result); // Direct execution of attacker-controlled input
}
```
* The `onCaptchaResult()` function directly passes CAPTCHA results (sent from the user) into `eval()`
* No sanitization or validation is performed on this input
* A malicious CAPTCHA result can include JavaScript such as
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-07-15
Published