https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 17:17:36 +0000 https://cve.radiocsirt.org/vuln/cve-2026-45348 <p><strong>Affected:</strong> pyload</p> <p>pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the packages.js template at src/pyload/webui/app/themes/modern/templates/js/packages.js:172 interpolates a stored link URL into a template literal inside single-quoted HTML and then writes the result to the DOM via $(div).html(html). No escaping runs between the API value and innerHTML. An attacker (Alice) who can submit a package link puts a single quote plus event handler into the URL, breaks out of the attribute, and executes JavaScript in every operator&#39;s browser that opens the downloads view. The theme does not set a Content Security Policy that restricts inline script or event handlers. This vulnerability is fixed in 0.5.0b3.dev100.</p> <p><strong>Affected:</strong> pyload</p> <p>pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the packages.js template at src/pyload/webui/app/themes/modern/templates/js/packages.js:172 interpolates a stored link URL into a template literal inside single-quoted HTML and then writes the result to the DOM via $(div).html(html). No escaping runs between the API value and innerHTML. An attacker (Alice) who can submit a package link puts a single quote plus event handler into the URL, breaks out of the attribute, and executes JavaScript in every operator&#39;s browser that opens the downloads view. The theme does not set a Content Security Policy that restricts inline script or event handlers. This vulnerability is fixed in 0.5.0b3.dev100.</p> https://cve.radiocsirt.org/vuln/cve-2026-45348 https://cve.radiocsirt.org/vuln/ghsa-fcjq-435v-jx94 <p><strong>Affected:</strong> PyPI: pyload-ng</p> <p>## Summary</p> <p>The `packages.js` template at `src/pyload/webui/app/themes/modern/templates/js/packages.js:172` interpolates a stored link URL into a template literal inside single-quoted HTML and then writes the result to the DOM via `$(div).html(html)`. No escaping runs between the API value and `innerHTML`. An attacker (Alice) who can submit a package link puts a single quote plus event handler into the URL, breaks out of the attribute, and executes JavaScript in every operator&#39;s browser that opens the downloads view. The theme does not set a Content Security Policy that restricts inline script or event handlers.</p> <p>## Details</p> <p>**Sink**: `src/pyload/webui/app/themes/modern/templates/js/packages.js:165-188`:</p> <p>```javascript const html = ` &lt;span class=&#39;child_status&#39;&gt; &lt;span style=&#39;margin-right: 2px;color: #337ab7;&#39; class=&#39;${link.icon}&#39;&gt;&lt;/span&gt; &lt;/span&gt; &lt;span style=&#39;font-size: 16px; font-weight: bold;&#39;&gt; &lt;a onclick=&#39;return false&#39; href=&#39;${link.url}&#39;&gt;${link.name}&lt;/a&gt; &lt;/span&gt;&lt;br/&gt; &lt;div class=&#39;child_secrow&#39; ...&gt; &lt;span class=&#39;child_status&#39; ...&gt;${link.statusmsg}&lt;/span&gt;&amp;nbsp;${link.error}&amp;nbsp; &lt;span class=&#39;child_status&#39; ...&gt;${link.format_size}&lt;/span&gt; &lt;span class=&#39;child_status&#39; ...&gt; ${link.plugin}&lt;/span&gt;... &lt;/div&gt;`;</p> <p>const div = document.createElement(&#34;div&#34;); $(div).attr(&#34;id&#34;, `file_${link.id}`); $(div).css(&#34;padding-left&#34;, &#34;30px&#34;); $(div).css(&#34;cursor&#34;, &#34;grab&#34;); $(div).addClass(&#34;child&#34;); $(div).html(html); ```</p> <p>`link.url` flows in from `/a…</p> <p><strong>Affected:</strong> PyPI: pyload-ng</p> <p>## Summary</p> <p>The `packages.js` template at `src/pyload/webui/app/themes/modern/templates/js/packages.js:172` interpolates a stored link URL into a template literal inside single-quoted HTML and then writes the result to the DOM via `$(div).html(html)`. No escaping runs between the API value and `innerHTML`. An attacker (Alice) who can submit a package link puts a single quote plus event handler into the URL, breaks out of the attribute, and executes JavaScript in every operator&#39;s browser that opens the downloads view. The theme does not set a Content Security Policy that restricts inline script or event handlers.</p> <p>## Details</p> <p>**Sink**: `src/pyload/webui/app/themes/modern/templates/js/packages.js:165-188`:</p> <p>```javascript const html = ` &lt;span class=&#39;child_status&#39;&gt; &lt;span style=&#39;margin-right: 2px;color: #337ab7;&#39; class=&#39;${link.icon}&#39;&gt;&lt;/span&gt; &lt;/span&gt; &lt;span style=&#39;font-size: 16px; font-weight: bold;&#39;&gt; &lt;a onclick=&#39;return false&#39; href=&#39;${link.url}&#39;&gt;${link.name}&lt;/a&gt; &lt;/span&gt;&lt;br/&gt; &lt;div class=&#39;child_secrow&#39; ...&gt; &lt;span class=&#39;child_status&#39; ...&gt;${link.statusmsg}&lt;/span&gt;&amp;nbsp;${link.error}&amp;nbsp; &lt;span class=&#39;child_status&#39; ...&gt;${link.format_size}&lt;/span&gt; &lt;span class=&#39;child_status&#39; ...&gt; ${link.plugin}&lt;/span&gt;... &lt;/div&gt;`;</p> <p>const div = document.createElement(&#34;div&#34;); $(div).attr(&#34;id&#34;, `file_${link.id}`); $(div).css(&#34;padding-left&#34;, &#34;30px&#34;); $(div).css(&#34;cursor&#34;, &#34;grab&#34;); $(div).addClass(&#34;child&#34;); $(div).html(html); ```</p> <p>`link.url` flows in from `/a…</p> https://cve.radiocsirt.org/vuln/ghsa-fcjq-435v-jx94