CVE-2023-0297: pyLoad code injection allows unauthenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network-reachable, unauthenticated code execution and very high EPSS make this an urgent patch target.

What it is

pyLoad before 0.5.0b3.dev31 contains a code injection flaw (CWE-94) in its js2py-based JavaScript handling. Because the vulnerable path is reachable over the network without credentials, it exposes the download manager to full remote code execution.

Impact

An attacker can execute arbitrary code with the privileges of the pyLoad process, leading to full compromise of the host and any data it can reach.

Attack surface

Reached over the network via the pyLoad web interface/API; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV, but EPSS is 0.95915 (99.871st percentile) and references include an Exploit-tagged huntr bounty plus public Packet Storm RCE write-ups, indicating public exploit material exists.

What to do

• Upgrade pyLoad to 0.5.0b3.dev31 or later (patch commit 7d73ba7919e594d783b3411d7ddb87885aea782d).
• If immediate upgrade is not possible, remove pyLoad from untrusted networks and restrict access to a trusted management network or VPN.
• Run pyLoad under a dedicated low-privilege account with no access to sensitive files or credentials.
• Monitor the pyLoad project and vendor advisories for further fixes or workarounds.

Detection

• Inspect pyLoad process logs and web access logs for requests to js2py-related endpoints or unusual JavaScript payloads.
• Alert on unexpected child processes, shell commands, or outbound connections spawned by the pyLoad process.
• Hunt for known public exploit payload patterns from the Packet Storm and huntr references in HTTP request bodies.
• Baseline normal pyLoad network behavior and alert on anomalous outbound traffic from the pyLoad host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.