https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T22:08:39.269515+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-322581 EUVD-2026-322581 2026-10-02T22:08:39.348698+00:00 EUVD-2026-322581 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45348 fkie_cve-2026-45348 2026-10-02T22:08:39.348743+00:00

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the packages.js template at src/pyload/webui/app/themes/modern/templates/js/packages.js:172 interpolates a stored link URL into a template literal inside single-quoted HTML and then writes the result to the DOM via $(div).html(html). No escaping runs between the API value and innerHTML. An attacker (Alice) who can submit a package link puts a single quote plus event handler into the URL, breaks out of the attribute, and executes JavaScript in every operator's browser that opens the downloads view. The theme does not set a Content Security Policy that restricts inline script or event handlers. This vulnerability is fixed in 0.5.0b3.dev100.

 https://cve.radiocsirt.org/vuln/ghsa-fcjq-435v-jx94 GHSA-fcjq-435v-jx94 — pyLoad is vulnerable to stored XSS in Downloads view via unsanitized link URL in packages.js template literal 2026-10-02T22:08:39.348793+00:00

Affected: PyPI: pyload-ng

## Summary

The `packages.js` template at `src/pyload/webui/app/themes/modern/templates/js/packages.js:172` interpolates a stored link URL into a template literal inside single-quoted HTML and then writes the result to the DOM via `$(div).html(html)`. No escaping runs between the API value and `innerHTML`. An attacker (Alice) who can submit a package link puts a single quote plus event handler into the URL, breaks out of the attribute, and executes JavaScript in every operator's browser that opens the downloads view. The theme does not set a Content Security Policy that restricts inline script or event handlers.

## Details

**Sink**: `src/pyload/webui/app/themes/modern/templates/js/packages.js:165-188`:

```javascript const html = ` <span class='child_status'> <span style='margin-right: 2px;color: #337ab7;' class='${link.icon}'></span> </span> <span style='font-size: 16px; font-weight: bold;'> <a onclick='return false' href='${link.url}'>${link.name}</a> </span><br/> <div class='child_secrow' ...> <span class='child_status' ...>${link.statusmsg}</span>&nbsp;${link.error}&nbsp; <span class='child_status' ...>${link.format_size}</span> <span class='child_status' ...> ${link.plugin}</span>... </div>`;

const div = document.createElement("div"); $(div).attr("id", `file_${link.id}`); $(div).css("padding-left", "30px"); $(div).css("cursor", "grab"); $(div).addClass("child"); $(div).html(html); ```

`link.url` flows in from `/a…

 https://cve.radiocsirt.org/vuln/pysec-2026-2994 PYSEC-2026-2994 — pyLoad is vulnerable to stored XSS in Downloads view via unsanitized link URL in packages.js template literal 2026-10-02T22:08:39.348889+00:00

Affected: PyPI: pyload-ng

## Summary

The `packages.js` template at `src/pyload/webui/app/themes/modern/templates/js/packages.js:172` interpolates a stored link URL into a template literal inside single-quoted HTML and then writes the result to the DOM via `$(div).html(html)`. No escaping runs between the API value and `innerHTML`. An attacker (Alice) who can submit a package link puts a single quote plus event handler into the URL, breaks out of the attribute, and executes JavaScript in every operator's browser that opens the downloads view. The theme does not set a Content Security Policy that restricts inline script or event handlers.

## Details

**Sink**: `src/pyload/webui/app/themes/modern/templates/js/packages.js:165-188`:

```javascript const html = ` <span class='child_status'> <span style='margin-right: 2px;color: #337ab7;' class='${link.icon}'></span> </span> <span style='font-size: 16px; font-weight: bold;'> <a onclick='return false' href='${link.url}'>${link.name}</a> </span><br/> <div class='child_secrow' ...> <span class='child_status' ...>${link.statusmsg}</span>&nbsp;${link.error}&nbsp; <span class='child_status' ...>${link.format_size}</span> <span class='child_status' ...> ${link.plugin}</span>... </div>`;

const div = document.createElement("div"); $(div).attr("id", `file_${link.id}`); $(div).css("padding-left", "30px"); $(div).css("cursor", "grab"); $(div).addClass("child"); $(div).html(html); ```

`link.url` flows in from `/a…