CVE-2025-57751
published 2025-08-21CVE-2025-57751: pyLoad is the free and open-source Download Manager written in pure Python. The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of jk…
PriorityP344high7.7CVSS 4.0
AVNACLATNPRNUINVCNVINVAHSCNSINSANEPCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.30%
21.6th percentile
pyLoad is the free and open-source Download Manager written in pure Python. The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of jk parameter verification, the jk parameter input by the user is directly determined as dykpy.evaljs(), resulting in the server CPU being fully occupied and the web-ui becoming unresponsive. This vulnerability is fixed in 0.5.0b3.dev92.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| pyload-ng_project | pyload-ng | >= 0 < 0.5.0b3.dev92 | 0.5.0b3.dev92 |
| pyload | pyload | < 0.5.0b3.dev92 | 0.5.0b3.dev92 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs
osv·2025-08-21
CVE-2025-57751 [HIGH] Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs
Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs
Dear Maintainers,
I am writing to you on behalf of the Tencent AI Sec. We have identified a potential vulnerability in one of your products and would like to report it to you for further investigation and mitigation.
### Summary
The `jk` parameter is received in pyLoad CNL Blueprint. Due to the lack of `jk` parameter verification, the `jk` parameter input by the user is directly determined as dykpy.evaljs(), resulting in the server CPU being fully occupied and the web-ui becoming unresponsive.
### Details
- Endpoint: flash/addcrypted2
- affected file: https://github.com/pyload/pyload/blob/develop/src/pyload/webui/app/blueprints/cnl_blueprint.py#L123
https://github.com/pyload/pyload/blob/develop/src/pyload/core/utils/mis
GHSA
Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs
ghsa·2025-08-21
CVE-2025-57751 [HIGH] CWE-400 Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs
Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs
Dear Maintainers,
I am writing to you on behalf of the Tencent AI Sec. We have identified a potential vulnerability in one of your products and would like to report it to you for further investigation and mitigation.
### Summary
The `jk` parameter is received in pyLoad CNL Blueprint. Due to the lack of `jk` parameter verification, the `jk` parameter input by the user is directly determined as dykpy.evaljs(), resulting in the server CPU being fully occupied and the web-ui becoming unresponsive.
### Details
- Endpoint: flash/addcrypted2
- affected file: https://github.com/pyload/pyload/blob/develop/src/pyload/webui/app/blueprints/cnl_blueprint.py#L123
https://github.com/pyload/pyload/blob/develop/src/pyload/core/utils/mis
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-08-21
Published