CVE-2026-45348: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the packages.js template at…

PriorityP346high8.7CVSS 3.1

AVNACLPRLUIRSCCHIHAN

EPSS

0.20%

9.9th percentile

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the packages.js template at src/pyload/webui/app/themes/modern/templates/js/packages.js:172 interpolates a stored link URL into a template literal inside single-quoted HTML and then writes the result to the DOM via $(div).html(html). No escaping runs between the API value and innerHTML. An attacker (Alice) who can submit a package link puts a single quote plus event handler into the URL, breaks out of the attribute, and executes JavaScript in every operator's browser that opens the downloads view. The theme does not set a Content Security Policy that restricts inline script or event handlers. This vulnerability is fixed in 0.5.0b3.dev100.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
pyload-ng_project	pyload-ng	0 – 0.5.0b3.dev99	—
pyload	pyload	< 0.5.0b3.dev100	0.5.0b3.dev100

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.