PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter
Priority HIGH 75CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.
Summary
pyLoad is the free and open-source Download Manager written in pure Python. Prior to version 0.5.0b3.dev91, the parameter add_links in API /json/add_package is vulnerable to SQL Injection. Attackers can modify or delete data in the database, causing data errors or loss. This issue has been patched in version 0.5.0b3.dev91.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00363 30th percentileScored 2026-11-07
Fix Fixed pyload (pyload): 0.5.0b3.dev91pyload-ng (PyPI): 0.5.0b3.dev91
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pyload | pyload | before 0.5.0b3.dev91 | 0.5.0b3.dev91 | Patch available | CNA |
| — | pyload-ng (PyPI) | before 0.5.0b3.dev91 | 0.5.0b3.dev91 | Patch available | GHSA-pwh4-6r3m-j2rf |
- pyload Vendorpyload Affected before 0.5.0b3.dev91 Fixed in 0.5.0b3.dev91 Patch available CNA
- pyload-ng (PyPI) Vendor— Affected before 0.5.0b3.dev91 Fixed in 0.5.0b3.dev91 Patch available GHSA-pwh4-6r3m-j2rf
Remediation
- Fix · CNA pyload (pyload) Fixed in 0.5.0b3.dev91
- Fix · GHSA-pwh4-6r3m-j2rf pyload-ng (PyPI) Fixed in 0.5.0b3.dev91 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-55156
- 2026-10-03 Alias added: GHSA-pwh4-6r3m-j2rf
References
More pyload vulnerabilities
- TI-2023-00282 Code Injection in pyload/pyload CVSS 3.1CRITICAL 9.8
- TI-2025-34556 pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE) CVSS 3.1CRITICAL 9.8
- TI-2025-33765 pyLoad vulnerable to remote code execution through js2py onCaptchaResult CVSS 3.1CRITICAL 9.8
- TI-2023-00412 Excessive Attack Surface in pyload/pyload CVSS 3.1CRITICAL 9.8
- TI-2026-27589 pyLoad has SSRF fix bypass via HTTP redirect CVSS 4.0CRITICAL 9.3
- TI-2026-26332 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration CVSS 4.0CRITICAL 9.3
Sources
- CVE-2025-55156 · CVE Program
- CVE-2025-55156 · NVD
- FIRST EPSS
- GHSA-pwh4-6r3m-j2rf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences