PT-2025-29530 · Pyload · Pyload

Odaysec · Published 2025-07-14 · Updated 2025-07-29 · CVE-2025-53890

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pyload versions prior to 0.5.0b3.dev89

Description pyload is an open-source Download Manager written in pure Python. An unsafe JavaScript evaluation vulnerability in pyLoad’s CAPTCHA processing code allows unauthenticated remote attackers to execute arbitrary code in the client browser and potentially the backend server. Exploitation requires no user interaction or authentication and can result in session hijacking, credential theft, and full system remote code execution.

Recommendations Update to version 0.5.0b3.dev89, which includes commit 909e5c97885237530d1264cfceb5555870eb9546 to resolve the issue.

Exploit

Fix

RCE

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

CVE-2025-53890

GHSA-8W3F-4R8F-PF53

Affected Products

Pyload

References · 17

• 🔥 https://github.com/pyload/pyload/security/advisories/GHSA-8w3f-4r8f-pf53 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53890.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-53890 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53890 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8w3f-4r8f-pf53 · Vendor Advisory
• https://github.com/pyload/pyload · Note
• https://github.com/pyload/pyload/pull/4586 · Note
• https://github.com/pyload/pyload/commit/909e5c97885237530d1264cfceb5555870eb9546 · Note
• https://twitter.com/vulert_official/status/1945731373219594650 · Twitter Post
• https://twitter.com/jmdevlabs/status/1950223314732896402 · Twitter Post
• https://twitter.com/cracbot/status/1946887850651496639 · Twitter Post
• https://twitter.com/CVEnew/status/1944929029720826065 · Twitter Post
• https://twitter.com/CCBalert/status/1945140414375174644 · Twitter Post
• https://twitter.com/CveFindCom/status/1944912371069141443 · Twitter Post
• https://twitter.com/SecAideInfo/status/1945789912751452572 · Twitter Post