Remote-Code-Execution-CVE-2024-28397-pyload-ng-js2py-

远程代码执行 – CVE-2024-28397 pyload-ng / js2py 本仓库包含针对 CVE-2024-28397 的概念验证（PoC） 利用代码，该漏洞是 pyload-ng 因不安全使用 js2py 而导致的远程代码执行漏洞。 免责声明： 此 PoC 仅用于教育和研究目的 。 请勿在非您所有或未经明确授权测试的系统上使用。 作者对任何滥用此代码的行为概不负责 。 漏洞详情 CVE ID： CVE-2024-28397 组件： pyload-ng 中的 js2py 影响： 远程代码执行（RCE） 攻击向量： 恶意 JS 载荷逃逸 js2py 沙箱并执行任意系统命令。...

CVE-2023-0297

CVE-2023-0297 認証なしのリモートコード実行 - PyLoad 0.5.0b3.dev31 における 免責事項：このスクリプトはシステムのセキュリティ監査のために作成されています。自分のシステム、または悪用する書面による許可を得たシステムでのみ使用してください。...

CVE-2023-0297_Pre-auth_RCE_in_pyLoad

CVE-2023-0297: pyLoad中的预认证RCE 发现pyLoad中预认证RCE的故事 TL;DR pyLoad版本0.5.0b3.dev31之前存在一个代码注入漏洞，通过滥用js2py的功能可实现预认证RCE。 报告见此处，漏洞利用代码见此处。 详情 pyLoad是一个用Python编写的开源下载管理器，可通过Web界面管理。截至2023年1月9日，其GitHub仓库约有2.8k星标。 在我审计pyLoad源代码时，以下代码引起了我的注意： cnlblueprint.pyL124 root@kitploit: jk = evaljsf"jk f" evaljs函数的定义如下：...

CVE-2023-0297

pyloadCVE-2023-0297PoC pyLoad 0.5.0b3.dev31 より前のバージョンにおけるコードインジェクションの脆弱性により、js2py の機能を悪用して認証前の RCE が可能になります。 使用方法 CVE-2023-0297poc.exe の使用方法: root@kitploit: -f string fileName:IP.txt -u string example:http://127.0.0.1:8080...

ensimag-secu3a-cve-2024-22416

CVE-2024-22416 参考报告：GHSA-pgpj-v85q-h5fm 该仓库包含一个 docker compose 配置，用于搭建一个 pyLoad 服务器和一个仅提供 csrf.html 的攻击者服务器。若要自行测试，只需运行 docker composer up（除 docker 外，你还需要安装 docker composer）。 然后，首先访问 localhost:8000（pyLoad 登录页面），使用用户 pyload 和密码 pyload 登录。接着，访问 localhost:8001/csrf.html，该页面会立即向 pyLoad API...

CVE-2024-39205-Pyload-RCE

CVE-2024-39205-Pyload-RCE 利用 js2py 沙箱逃逸实现 Pyload RCE 摘要 任何运行在 python3.11 或更低版本下的 pyload-ng 都存在 RCE 漏洞。攻击者可以发送包含任意 shell 命令的请求，受害服务器将立即执行该命令。 修复方案 升级到最新版本的 pyload-ng，或者直接用 python3.12 或更高版本运行 pyload。 详情 js2py 存在一个沙箱逃逸漏洞，编号为 CVE-2024-28397，该漏洞被 pyload-ng 的 /flash/addcrypted2 API 端点所使用。虽然此端点设计为仅接受...

pyLoad Flask Config - Access Control

pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the SECRETKEY variable. This issue has been patched in version 0.5.0b3.dev77. id: CVE-2024-21644 info: name: pyLoad Flask Config ...

pyload - Log Injection

A log injection vulnerability was identified in pyload. This vulnerability allows any unauthenticated actor to inject arbitrary messages into the logs gathered by pyload. id: CVE-2024-21645 info: name: pyload - Log Injection author: isacaya severity: medium description: | A log injection...

pyload-ng js2py - Remote Code Execution

An issue in the component js2py.disablepyimport of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call. id: CVE-2024-28397 info: name: pyload-ng js2py - Remote Code Execution author: iamnoooob,rootxharsh,pdresearch severity: medium description: | An issue in the...

CVE-2023-0297

CVE-2023-0297 pyload 0.5.0b3.dev31 より前のバージョンにおけるRCE。 免責事項：このスクリプトは、リモートシステムへの不正アクセスまたは制御を引き起こす可能性があります。使用する前に、システム所有者から明示的な許可を得ている場合にのみ使用してください。...

PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)

Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31. id: CVE-2023-0297 info: name: PyLoad 0.5.0 - Pre-auth Remote Code Execution RCE author: MrHarshvardhan,DhiyaneshDk severity: critical description: | Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31...

PYSEC-2026-2995 pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs

Summary isglobaladdress in src/pyload/core/utils/web/check.py is the central guard against SSRF-style outbound connections in pyload-ng. It tests whether a given IP is "globally routable" via Python's ipaddress.ipaddressvalue.isglobal, and callers treat not isglobal as "deny": python def...

PYSEC-2026-2992 pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager

Description: The EventManager module in pyload manages a list of Client instances for subscribing to events. The addition of each unique uuid from the getevents API causes the creation of a Client instance that gets appended to the clients list. Although there is a clean method available in the...

PYSEC-2026-2998 pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad

Summary The fix for CVE-2026-33509 prevents setting storagefolder inside PKGDIR or userdir, but does NOT protect the Flask session directory /tmp/pyLoad/flask. An authenticated attacker can set storagefolder to the session directory and download session files of other users via /files/get/, leadi...

PYSEC-2026-2993 PyLoad vulnerable to unauthenticated traceback disclosure via global exception handler in WebUI

Summary pyload-ng WebUI returns full Python traceback details to clients on unhandled exceptions. Because /web/ is reachable without authentication and renders attacker-controlled template names, an unauthenticated user can reliably trigger a server exception for example by requesting a...

PYSEC-2026-2990 pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)

Summary pyLoad caches role and permission in the session at login and continues to authorize requests using these cached values, even after an admin changes the user's role/permissions in the database. As a result, an already logged-in user can keep old revoked privileges until logout/session...

PYSEC-2026-2997 pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions

Summary Several WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke. This allows authenticated low-privileged users to execute MODIFY operations that should be denied by pyLoad's own permission model. Confirmed mismatches: - ADD user can reorder packages/files...

PYSEC-2026-2988 pyLoad: SSRF in parse_urls API endpoint via unvalidated URL parameter

Vulnerability Details CWE-918: Server-Side Request Forgery SSRF The parseurls API function in src/pyload/core/api/init.py line 556 fetches arbitrary URLs server-side via geturlurl pycurl without any URL validation, protocol restriction, or IP blacklist. An authenticated user with ADD permission...

CVE-2026-48737

creationtimestamp| type| source ---|---|--- 2026-07-09 14:35:19+00:00| published-proof-of-concept| https://github.com/pyload/pyload/security/advisories/GHSA-m5x5-28jr-gpjj...

ez-pyload (>=1.0.0, <=1.0.4) potentially affected by CVE-2026-48987 via pyload-ng (0.5.0b3.dev101)

pyload-ng PYPI version 0.5.0b3.dev101 is affected by a known vulnerability. The following packages have a transitive dependency on pyload-ng and may be impacted: - ez-pyload =1.0.0, =1.0.4 Source cves: CVE-2026-48987 Source advisory: SNYK:PYTHON-PYLOADNG-17911017...