Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs
Priority HIGH 73CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.
Summary
pyLoad is the free and open-source Download Manager written in pure Python. The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of jk parameter verification, the jk parameter input by the user is directly determined as dykpy.evaljs(), resulting in the server CPU being fully occupied and the web-ui becoming unresponsive. This vulnerability is fixed in 0.5.0b3.dev92.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00325 25th percentileScored 2026-11-07
Fix Fixed pyload (pyload): 0.5.0b3.dev92pyload-ng (PyPI): 0.5.0b3.dev92
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pyload | pyload | before 0.5.0b3.dev92 | 0.5.0b3.dev92 | Patch available | CNA |
| — | pyload-ng (PyPI) | before 0.5.0b3.dev92 | 0.5.0b3.dev92 | Patch available | GHSA-9gjj-6gj7-c4wj |
- pyload Vendorpyload Affected before 0.5.0b3.dev92 Fixed in 0.5.0b3.dev92 Patch available CNA
- pyload-ng (PyPI) Vendor— Affected before 0.5.0b3.dev92 Fixed in 0.5.0b3.dev92 Patch available GHSA-9gjj-6gj7-c4wj
Remediation
- Fix · CNA pyload (pyload) Fixed in 0.5.0b3.dev92
- Fix · GHSA-9gjj-6gj7-c4wj pyload-ng (PyPI) Fixed in 0.5.0b3.dev92 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-57751
- 2026-10-03 Alias added: GHSA-9gjj-6gj7-c4wj
References
More pyload vulnerabilities
- TI-2023-00282 Code Injection in pyload/pyload CVSS 3.1CRITICAL 9.8
- TI-2025-34556 pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE) CVSS 3.1CRITICAL 9.8
- TI-2025-33765 pyLoad vulnerable to remote code execution through js2py onCaptchaResult CVSS 3.1CRITICAL 9.8
- TI-2023-00412 Excessive Attack Surface in pyload/pyload CVSS 3.1CRITICAL 9.8
- TI-2026-27589 pyLoad has SSRF fix bypass via HTTP redirect CVSS 4.0CRITICAL 9.3
- TI-2026-26332 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration CVSS 4.0CRITICAL 9.3
Sources
- CVE-2025-57751 · CVE Program
- CVE-2025-57751 · NVD
- FIRST EPSS
- GHSA-9gjj-6gj7-c4wj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences