# pyload-ng (PyPI) vulnerabilities 50 known vulnerabilities (10 critical, 18 high, 20 medium, 2 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 0.5.0b3.dev102 (Oct 28, 2026): affected by 5 advisories - Newest unaffected release: Every release is affected by at least one advisory - Weekly downloads: 1,558 - Dependents: 1 - Releases: 107 since 0.5.0a5.dev528 (Jun 11, 2019) - Registry: https://pypi.org/project/pyload-ng/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - GHSA-P3PR-8F3M-4QP8: 0.5.0a5.dev528 to 0.5.0b3.dev101 (0.5.0b3.dev102 is outside it) - CVE-2026-75597: 0.5.0a5.dev528 to 0.5.0b3.dev100 (0.5.0b3.dev101 is outside it) - CVE-2026-48484: 0.5.0a5.dev528 to 0.5.0b3.dev100 (0.5.0b3.dev101 is outside it) - CVE-2026-48987: 0.5.0a5.dev528 to 0.5.0b3.dev100 (0.5.0b3.dev101 is outside it) - CVE-2026-48737: 0.5.0a5.dev528 to 0.5.0b3.dev100 (0.5.0b3.dev101 is outside it) - CVE-2026-45306: 0.5.0a5.dev528 to 0.5.0b3.dev99 (0.5.0b3.dev100 is outside it) - CVE-2026-45348: 0.5.0a5.dev528 to 0.5.0b3.dev99 (0.5.0b3.dev100 is outside it) - CVE-2026-46561: 0.5.0a5.dev528 to 0.5.0b3.dev99 (0.5.0b3.dev100 is outside it) - CVE-2026-44226: 0.5.0a5.dev528 to 0.5.0b3.dev99 (0.5.0b3.dev100 is outside it) - CVE-2026-42315: 0.5.0a5.dev528 to 0.5.0b3.dev99 (0.5.0b3.dev100 is outside it) - CVE-2026-42314: 0.5.0a5.dev528 to 0.5.0b3.dev99 (0.5.0b3.dev100 is outside it) - CVE-2026-42312: 0.5.0a5.dev528 to 0.5.0b3.dev99 (0.5.0b3.dev100 is outside it) - CVE-2026-42313: 0.5.0a5.dev528 to 0.5.0b3.dev99 (0.5.0b3.dev100 is outside it) - CVE-2026-41133: 0.5.0a5.dev528 to 0.5.0b3.dev97 (0.5.0b3.dev98 is outside it) - CVE-2026-40594: 0.5.0a5.dev528 to 0.5.0b3.dev97 (0.5.0b3.dev98 is outside it) - CVE-2026-40071: 0.5.0a5.dev528 to 0.5.0b3.dev96 (0.5.0b3.dev97 is outside it) - CVE-2026-35592: 0.5.0a5.dev528 to 0.5.0b3.dev96 (0.5.0b3.dev97 is outside it) - CVE-2026-35586: 0.5.0a5.dev528 to 0.5.0b3.dev96 (0.5.0b3.dev97 is outside it) - CVE-2026-35464: 0.5.0a5.dev528 to 0.5.0b3.dev102 (through the newest release) - CVE-2026-35463: 0.5.0a5.dev528 to 0.5.0b3.dev96 (0.5.0b3.dev97 is outside it) - CVE-2026-35459: 0.5.0a5.dev528 to 0.5.0b3.dev96 (0.5.0b3.dev97 is outside it) - CVE-2026-35187: 0.5.0a5.dev528 to 0.5.0b3.dev96 (0.5.0b3.dev97 is outside it) - CVE-2026-33992: 0.5.0a5.dev528 to 0.5.0b3.dev96 (0.5.0b3.dev97 is outside it) - CVE-2026-33509: 0.5.0a5.dev528 to 0.5.0b3.dev96 (0.5.0b3.dev97 is outside it) - CVE-2026-33314: 0.5.0a5.dev528 to 0.5.0b3.dev96 (0.5.0b3.dev97 is outside it) - CVE-2026-29778: 0.5.0b3.dev13 to 0.5.0b3.dev96 (0.5.0b3.dev97 is outside it) - CVE-2025-61773: 0.5.0a5.dev528 to 0.5.0b3.dev90 (0.5.0b3.dev91 is outside it) - CVE-2025-57751: 0.5.0a5.dev528 to 0.5.0b3.dev91 (0.5.0b3.dev92 is outside it) - CVE-2025-55156: 0.5.0a5.dev528 to 0.5.0b3.dev90 (0.5.0b3.dev91 is outside it) - CVE-2025-54802: 0.5.0a5.dev528 to 0.5.0b3.dev89 (0.5.0b3.dev90 is outside it) - CVE-2025-54140: 0.5.0b3.dev89 (0.5.0b3.dev90 is outside it) - CVE-2025-53890: 0.5.0a5.dev528 to 0.5.0b3.dev102 (through the newest release) - CVE-2025-7346: 0.5.0a5.dev528 to 0.5.0b3.dev88 (0.5.0b3.dev89 is outside it) - CVE-2024-1240: 0.5.0a5.dev528 to 0.5.0b3.dev102 (through the newest release) - CVE-2024-39205: 0.5.0a5.dev528 to 0.5.0b3.dev85 (0.5.0b3.dev87 is outside it) - CVE-2024-47821: 0.5.0a5.dev528 to 0.5.0b3.dev102 (through the newest release) - CVE-2024-32880: 0.5.0a5.dev528 to 0.5.0b3.dev102 (through the newest release) - CVE-2024-24808: 0.5.0a5.dev528 to 0.5.0b3.dev78 (0.5.0b3.dev79 is outside it) - CVE-2024-22416: 0.5.0a5.dev528 to 0.5.0b3.dev77 (0.5.0b3.dev78 is outside it) - CVE-2024-21644: 0.5.0a5.dev528 to 0.5.0b3.dev76 (0.5.0b3.dev77 is outside it) - CVE-2024-21645: 0.5.0a5.dev528 to 0.5.0b3.dev76 (0.5.0b3.dev77 is outside it) - CVE-2023-47890: 0.5.0a5.dev528 to 0.5.0b3.dev74 (0.5.0b3.dev75 is outside it) - CVE-2023-0509: 0.5.0a5.dev528 to 0.5.0b3.dev43 (0.5.0b3.dev44 is outside it) - CVE-2023-0488: 0.5.0a5.dev528 to 0.5.0b3.dev41 (0.5.0b3.dev42 is outside it) - CVE-2023-0435: 0.5.0a5.dev528 to 0.5.0b3.dev40 (0.5.0b3.dev41 is outside it) - CVE-2023-0434: 0.5.0a5.dev528 to 0.5.0b3.dev39 (0.5.0b3.dev40 is outside it) - CVE-2023-0297: 0.5.0a5.dev528 to 0.5.0b3.dev30 (0.5.0b3.dev31 is outside it) - CVE-2023-0227: 0.5.0a5.dev528 to 0.5.0b3.dev35 (0.5.0b3.dev38 is outside it) - CVE-2023-0057: 0.5.0a5.dev528 to 0.5.0b3.dev32 (0.5.0b3.dev33 is outside it) - CVE-2023-0055: 0.5.0a5.dev528 to 0.5.0b3.dev31 (0.5.0b3.dev32 is outside it) ## Advisories (50) ### [GHSA-P3PR-8F3M-4QP8](https://cve.now/GHSA-P3PR-8F3M-4QP8): pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host - Severity: Medium - Published: Oct 9, 2026 - Affected: through 0.5.0b3.dev101. - No fix released. ### [CVE-2026-75597](https://cve.now/CVE-2026-75597): pyLoad: Unauthenticated access to /web/\ bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo - Severity: Medium 5.3 - Published: Oct 9, 2026 - Affected: fixed in 0.5.0b3.dev101. - Fixed in 0.5.0b3.dev101 (released Jul 9, 2026, 92 days before disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2026-48484](https://cve.now/CVE-2026-48484): pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination - Severity: Medium 6.5 - Published: Oct 9, 2026 - Affected: fixed in 0.5.0b3.dev101. - Fixed in 0.5.0b3.dev101 (released Jul 9, 2026, 92 days before disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2026-48987](https://cve.now/CVE-2026-48987): pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager - Severity: Medium 6.5 - Published: Sep 15, 2026 - Affected: through 0.5.0b3.dev100. - No fix released. ### [CVE-2026-48737](https://cve.now/CVE-2026-48737): pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs - Severity: Medium 4.9 - Published: Sep 15, 2026 - Affected: through 0.5.0b3.dev100. - No fix released. ### [CVE-2026-45306](https://cve.now/CVE-2026-45306): pyLoad: Incomplete Fix for CVE-2026-33509 -storage\_folder Bypass via Session Directory - Severity: Medium 6.5 - Published: May 28, 2026 - Affected: through 0.5.0b3.dev99. - No fix released. ### [CVE-2026-45348](https://cve.now/CVE-2026-45348): pyLoad: Stored XSS in Downloads view via unsanitized link URL in packages.js template literal - Severity: High 8.7 - Published: May 28, 2026 - Affected: through 0.5.0b3.dev99. - No fix released. ### [CVE-2026-46561](https://cve.now/CVE-2026-46561): pyLoad: SSRF via HTTP Redirect Bypass in parse\_urls API - Severity: Medium 5.0 - Published: May 28, 2026 - Affected: fixed in 0.5.0b3.dev100. - Fixed in 0.5.0b3.dev100 (released May 17, 2026, 11 days before disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2026-44226](https://cve.now/CVE-2026-44226): pyLoad: Unauthenticated traceback disclosure via global exception handler in WebUI - Severity: Medium 5.3 - Published: May 11, 2026 - Affected: fixed in 0.5.0b3.dev100. - Fixed in 0.5.0b3.dev100 (released May 17, 2026, 6 days after disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2026-42315](https://cve.now/CVE-2026-42315): pyLoad: Path Traversal via Package Folder Name in set\_package\_data - Severity: High 8.1 - Published: May 11, 2026 - Affected: fixed in 0.5.0b3.dev100. - Fixed in 0.5.0b3.dev100 (released May 17, 2026, 6 days after disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2026-42314](https://cve.now/CVE-2026-42314): pyLoad: Path Traversal via Package Folder Name - Severity: Medium 6.5 - Published: May 11, 2026 - Affected: fixed in 0.5.0b3.dev100. - Fixed in 0.5.0b3.dev100 (released May 17, 2026, 6 days after disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2026-42312](https://cve.now/CVE-2026-42312): pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification - Severity: Medium 6.8 - Published: May 11, 2026 - Affected: fixed in 0.5.0b3.dev100. - Fixed in 0.5.0b3.dev100 (released May 17, 2026, 6 days after disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2026-42313](https://cve.now/CVE-2026-42313): pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy - Severity: High 8.3 - Published: May 11, 2026 - Affected: fixed in 0.5.0b3.dev100. - Fixed in 0.5.0b3.dev100 (released May 17, 2026, 6 days after disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2026-41133](https://cve.now/CVE-2026-41133): pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass) - Severity: High 8.8 - Published: Apr 21, 2026 - Affected: through 0.5.0b3.dev97. - No fix released. ### [CVE-2026-40594](https://cve.now/CVE-2026-40594): pyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition) - Severity: Medium 4.8 - Published: Apr 21, 2026 - Affected: fixed in 0.5.0b3.dev98; fixed in 0.5.0b3.dev69. - Fixed in 0.5.0b3.dev98 (released Apr 15, 2026, 6 days before disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2026-40071](https://cve.now/CVE-2026-40071): pyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actions - Severity: Medium 5.4 - Published: Apr 9, 2026 - Affected: fixed in 0.5.0b3.dev97. - Fixed in 0.5.0b3.dev97 (released Apr 7, 2026, 2 days before disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2026-35592](https://cve.now/CVE-2026-35592): pyLoad has an Incomplete Tar Path Traversal Fix in UnTar.\_safe\_extractall via os.path.commonprefix Bypass - Severity: Medium 5.3 - Published: Apr 7, 2026 - Affected: fixed in 0.5.0b3.dev97. - Fixed in 0.5.0b3.dev97 (released Apr 7, 2026, the day of disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2026-35586](https://cve.now/CVE-2026-35586): Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng - Severity: Medium 6.8 - Published: Apr 7, 2026 - Affected: fixed in 0.5.0b3.dev97. - Fixed in 0.5.0b3.dev97 (released Apr 7, 2026, the day of disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2026-35464](https://cve.now/CVE-2026-35464): pyLoad has an incomplete fix for CVE-2026-33509: unprotected storage\_folder enables arbitrary file write to Flask session store and code… - Severity: High 7.5 - Published: Apr 7, 2026 - Affected: through 0.5.0b3. - No fix released. The latest release, 0.5.0b3.dev102, is still affected. ### [CVE-2026-35463](https://cve.now/CVE-2026-35463): pyLoad has Improper Neutralization of Special Elements used in an OS Command - Severity: High 8.8 - Published: Apr 7, 2026 - Affected: fixed in 0.5.0b3.dev97; through 0.5.0b3.dev96. - Fixed in 0.5.0b3.dev97 (released Apr 7, 2026, the day of disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2026-35459](https://cve.now/CVE-2026-35459): pyLoad has SSRF fix bypass via HTTP redirect - Severity: Critical 9.3 - Published: Apr 6, 2026 - Affected: through 0.5.0b3.dev96. - No fix released. ### [CVE-2026-35187](https://cve.now/CVE-2026-35187): pyLoad has SSRF in parse\_urls API endpoint via unvalidated URL parameter - Severity: High 7.7 - Published: Apr 6, 2026 - Affected: through 0.5.0b3.dev96. - No fix released. ### [CVE-2026-33992](https://cve.now/CVE-2026-33992): pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration - Severity: Critical 9.3 - Published: Mar 27, 2026 - Affected: through 0.5.0b3.dev96. - No fix released. ### [CVE-2026-33509](https://cve.now/CVE-2026-33509): pyload-ng: SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration - Severity: High 7.5 - Published: Mar 24, 2026 - Affected: from 0.4.0, through 0.5.0b3.dev96. - No fix released. ### [CVE-2026-33314](https://cve.now/CVE-2026-33314): pyload-ng: Improper Authentication and Origin Validation Error - Severity: Medium 6.5 - Published: Mar 24, 2026 - Affected: fixed in 0.5.0b3.dev97. - Fixed in 0.5.0b3.dev97 (released Apr 7, 2026, 14 days after disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2026-29778](https://cve.now/CVE-2026-29778): pyLoad: Arbitrary File Write via Path Traversal in edit\_package() - Severity: High 7.1 - Published: Mar 7, 2026 - Affected: from 0.5.0b3.dev13, fixed in 0.5.0b3.dev97. - Fixed in 0.5.0b3.dev97 (released Apr 7, 2026, 31 days after disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2025-61773](https://cve.now/CVE-2025-61773): pyLoad CNL and captcha handlers allow code Injection via unsanitized parameters - Severity: High 8.1 - Published: Oct 9, 2025 - Affected: fixed in 0.5.0b3.dev91. - Fixed in 0.5.0b3.dev91 (released Aug 9, 2025, 61 days before disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2025-57751](https://cve.now/CVE-2025-57751): Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs - Severity: High 7.7 - Published: Aug 21, 2025 - Affected: fixed in 0.5.0b3.dev92. - Fixed in 0.5.0b3.dev92 (released Aug 21, 2025, the day of disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2025-55156](https://cve.now/CVE-2025-55156): PyLoad vulnerable to SQL Injection via API /json/add\_package in add\_links parameter - Severity: High 7.8 - Published: Aug 11, 2025 - Affected: fixed in 0.5.0b3.dev91. - Fixed in 0.5.0b3.dev91 (released Aug 9, 2025, 2 days before disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2025-54802](https://cve.now/CVE-2025-54802): pyLoad CNL Blueprint is vulnerable to Path Traversal through \`dlc\_path\` leading to Remote Code Execution (RCE) - Severity: Critical 9.8 - Published: Aug 5, 2025 - Affected: fixed in 0.5.0b3.dev90. - Fixed in 0.5.0b3.dev90 (released Aug 2, 2025, 3 days before disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2025-54140](https://cve.now/CVE-2025-54140): pyLoad has Path Traversal Vulnerability in json/upload Endpoint that allows Arbitrary File Write - Severity: High 7.5 - Published: Jul 22, 2025 - Affected: from 0.5.0b3.dev89, fixed in 0.5.0b3.dev90. - Fixed in 0.5.0b3.dev90 (released Aug 2, 2025, 11 days after disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2025-53890](https://cve.now/CVE-2025-53890): pyLoad vulnerable to remote code execution through js2py onCaptchaResult - Severity: Critical 9.8 - Published: Jul 14, 2025 - Affected: fixed in 0.20. - No fix released. The advisory names 0.20 as the fix, which the registry doesn't have yet. The latest release, 0.5.0b3.dev102, is still affected. ### [CVE-2025-7346](https://cve.now/CVE-2025-7346): Any unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packages - Severity: High 8.7 - Published: Jul 8, 2025 - Affected: through 0.5.0b3.dev88. - No fix released. ### [CVE-2024-1240](https://cve.now/CVE-2024-1240): Open Redirection in pyload/pyload - Severity: Medium 4.6 - Published: Nov 15, 2024 - Affected: all versions. - No fix released. The latest release, 0.5.0b3.dev102, is still affected. ### [CVE-2024-39205](https://cve.now/CVE-2024-39205): An issue in pyload-ng v0.5.0b3.dev85 running under python3.11 or below allows attackers to execute arbitrary code via a crafted HTTP… - Severity: Critical 9.8 - Published: Oct 28, 2024 - Affected: through 0.5.0b3.dev85. - No fix released. ### [CVE-2024-47821](https://cve.now/CVE-2024-47821): pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API - Severity: Critical 9.1 - Published: Oct 25, 2024 - Affected: fixed in 0.5.0b3.dev87; through 0.5.0. - No fix released. The latest release, 0.5.0b3.dev102, is still affected. ### [CVE-2024-32880](https://cve.now/CVE-2024-32880): pyLoad allows upload to arbitrary folder lead to RCE - Severity: Critical 9.1 - Published: Apr 26, 2024 - Affected: through 0.5.0. - No fix released. The latest release, 0.5.0b3.dev102, is still affected. ### [CVE-2024-24808](https://cve.now/CVE-2024-24808): pyLoad open redirect vulnerability due to improper validation of the is\_safe\_url function - Severity: Medium 4.7 - Published: Feb 6, 2024 - Affected: fixed in 0.5.0b3.dev79. - Fixed in 0.5.0b3.dev79 (released Feb 5, 2024, 1 day before disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2024-22416](https://cve.now/CVE-2024-22416): Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation - Severity: Critical 9.7 - Published: Jan 17, 2024 - Affected: fixed in 0.5.0b3.dev78. - Fixed in 0.5.0b3.dev78 (released Jan 17, 2024, the day of disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2024-21644](https://cve.now/CVE-2024-21644): pyLoad unauthenticated flask configuration leakage - Severity: High 7.5 - Published: Jan 8, 2024 - Affected: fixed in 0.5.0b3.dev77. - Fixed in 0.5.0b3.dev77 (released Jan 6, 2024, 2 days before disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2024-21645](https://cve.now/CVE-2024-21645): pyLoad Log Injection - Severity: Medium 5.3 - Published: Jan 8, 2024 - Affected: fixed in 0.5.0b3.dev77. - Fixed in 0.5.0b3.dev77 (released Jan 6, 2024, 2 days before disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2023-47890](https://cve.now/CVE-2023-47890): pyLoad 0.5.0 is vulnerable to Unrestricted File Upload. - Severity: High 8.8 - Published: Jan 8, 2024 - Affected: fixed in 0.5.0b3.dev75. - Fixed in 0.5.0b3.dev75 (released Nov 21, 2023, 48 days before disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2023-0509](https://cve.now/CVE-2023-0509): Improper Certificate Validation in pyload/pyload - Severity: High 7.4 - Published: Jan 26, 2023 - Affected: fixed in 0.5.0b3.dev44. - Fixed in 0.5.0b3.dev44 (released Jan 26, 2023, the day of disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2023-0488](https://cve.now/CVE-2023-0488): Cross-site Scripting (XSS) - Stored in pyload/pyload - Severity: Critical 9.6 - Published: Jan 26, 2023 - Affected: fixed in 0.5.0b3.dev42. - Fixed in 0.5.0b3.dev42 (released Jan 25, 2023, 1 day before disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2023-0435](https://cve.now/CVE-2023-0435): Excessive Attack Surface in pyload/pyload - Severity: Medium 4.0 - Published: Jan 22, 2023 - Affected: fixed in 0.5.0b3.dev41. - Fixed in 0.5.0b3.dev41 (released Jan 22, 2023, the day of disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2023-0434](https://cve.now/CVE-2023-0434): Improper Input Validation in pyload/pyload - Severity: Medium 5.4 - Published: Jan 22, 2023 - Affected: fixed in 0.5.0b3.dev40. - Fixed in 0.5.0b3.dev40 (released Jan 21, 2023, 1 day before disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2023-0297](https://cve.now/CVE-2023-0297): Code Injection in pyload/pyload - Severity: Critical 9.8 - Published: Jan 14, 2023 - Affected: fixed in 0.5.0b3.dev31. - Fixed in 0.5.0b3.dev31 (released Jan 3, 2023, 11 days before disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2023-0227](https://cve.now/CVE-2023-0227): Insufficient Session Expiration in pyload/pyload - Severity: High 8.3 - Published: Jan 12, 2023 - Affected: fixed in 0.5.0b3.dev36. - No fix released. The advisory names 0.5.0b3.dev36 as the fix, which the registry doesn't have yet. ### [CVE-2023-0057](https://cve.now/CVE-2023-0057): Improper Restriction of Rendered UI Layers or Frames in pyload/pyload - Severity: Low 3.1 - Published: Jan 5, 2023 - Affected: fixed in 0.5.0b3.dev33. - Fixed in 0.5.0b3.dev33 (released Jan 4, 2023, 1 day before disclosure). - The latest release, 0.5.0b3.dev102, is not affected. ### [CVE-2023-0055](https://cve.now/CVE-2023-0055): Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in pyload/pyload - Severity: Low 3.1 - Published: Jan 4, 2023 - Affected: fixed in 0.5.0b3.dev32. - Fixed in 0.5.0b3.dev32 (released Jan 4, 2023, the day of disclosure). - The latest release, 0.5.0b3.dev102, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/pyload-ng Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.