Most recent entries from all

EUVD-2026-250390

fkie_cve-2025-57751

pyLoad is the free and open-source Download Manager written in pure Python. The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of jk parameter verification, the jk parameter input by the user is directly determined as dykpy.evaljs(), resulting in the server CPU being fully occupied and the web-ui becoming unresponsive. This vulnerability is fixed in 0.5.0b3.dev92.

GHSA-9gjj-6gj7-c4wj — Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs

Affected: PyPI: pyload-ng

Dear Maintainers, I am writing to you on behalf of the Tencent AI Sec. We have identified a potential vulnerability in one of your products and would like to report it to you for further investigation and mitigation.

### Summary The `jk` parameter is received in pyLoad CNL Blueprint. Due to the lack of `jk` parameter verification, the `jk` parameter input by the user is directly determined as dykpy.evaljs(), resulting in the server CPU being fully occupied and the web-ui becoming unresponsive.

### Details - Endpoint: flash/addcrypted2 - affected file: https://github.com/pyload/pyload/blob/develop/src/pyload/webui/app/blueprints/cnl_blueprint.py#L123 https://github.com/pyload/pyload/blob/develop/src/pyload/core/utils/misc.py#L42

affected code ```python @bp.route("/flash/addcrypted2", methods=["POST"], endpoint="addcrypted2") @local_check def addcrypted2(): package = flask.request.form.get( "package", flask.request.form.get("source", flask.request.form.get("referer")) ) crypted = flask.request.form["crypted"] jk = flask.request.form["jk"] pack_password = flask.request.form.get("passwords")

crypted = standard_b64decode(unquote(crypted.replace(" ", "+"))) jk = eval_js(f"{jk} f()")

```

```python def eval_js(script, es6=False): if sys.version_info < (3, 12): return (js2py.eval_js6 if es6 else js2py.eval_js)(script) else: return dukpy.evaljs(script) ```

### PoC download pyload and run locally, send the following re…

PYSEC-2026-1815 — Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs

Affected: PyPI: pyload-ng

crypted = standard_b64decode(unquote(crypted.replace(" ", "+"))) jk = eval_js(f"{jk} f()")

```

```python def eval_js(script, es6=False): if sys.version_info < (3, 12): return (js2py.eval_js6 if es6 else js2py.eval_js)(script) else: return dukpy.evaljs(script) ```

### PoC download pyload and run locally, send the following re…