{“lastseen”:””,”description”:”pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the packages.js template at src\/pyload\/webui\/app\/themes\/modern\/templates\/js\/packages.js:172 interpolates a stored link URL into a template literal inside single-quoted HTML and then writes the result to the DOM via $(div).html(html). No escaping runs between the API value and innerHTML. An attacker (Alice) who can submit a package link puts a single quote plus event handler into the URL, breaks out of the attribute, and executes JavaScript in every operator’s browser that opens the downloads view. The theme does not set a Content Security Policy that restricts inline script or event handlers. This vulnerability is fixed in 0.5.0b3.dev100.”,”published”:”2026-05-28T17:12:20.497Z”,”modified”:”2026-05-28T17:12:20.497Z”,”type”:”cve”,”title”:”pyLoad: Stored XSS in Downloads view via unsanitized link URL in packages.js template literal”,”source”:”GitHub_M”,”references”:”https:\/\/github.com\/pyload\/pyload\/security\/advisories\/GHSA-fcjq-435v-jx94″,”id”:”CVE-2026-45348″,”bulletinFamily”:””,”cwe”:[“CWE-79″],”cvelist”:null,”sourceData”:”pyload pyload \\u003c 0.5.0b3.dev100″,”sourceHref”:””,”cvss”:{“score”:8.7,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:H\/I:H\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”pyload”,”version”:”\\u003c 0.5.0b3.dev100″,”vendor”:”pyload”,”ai_description”:”Stored XSS vulnerability in pyLoad download manager via unsanitized link URL in packages.js template literal”,”ai_severity”:”High”,”ai_vendor”:”pyload”,”ai_product”:”pyLoad”,”ai_version”:”\\u003c 0.5.0b3.dev100″,”ai_score”:8.7}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the packages.js template at src\/pyload\/webui\/app\/themes\/modern\/templates\/js\/packages.js:172 interpolates a stored link URL into…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,19,12,15,13,7,11,5],"class_list":["post-57876","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-87","tag-exploit","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n