CVE-2023-0297
Code Injection in pyload/pyload
Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Code Injection in pyload/pyload
Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.
- Record
CVE-2023-0297- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2023-0517
Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.
- Record
EUVD-2023-0517- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-pf38-5p22-x6h6
Code Injection in pyload-ng
Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.
- Record
GHSA-pf38-5p22-x6h6- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
NVD
Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.
- Record
CVE-2023-0297- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
Code Injection in pyload/pyload
Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.
- Record
CVE-2023-0297- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVGHSA-pf38-5p22-x6h6
Code Injection in pyload-ng
Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.
- Record
GHSA-pf38-5p22-x6h6- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVPYSEC-2026-498
Code Injection in pyload-ng
Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.
- Record
PYSEC-2026-498- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pyload-ngPyPI |
before 0.5.0b3.dev31 | 0.5.0b3.dev31 |
pyload-ngPyPI |
before 0.5.0b3.dev31, plus listed versions 0.5.0a5.dev5280.5.0a5.dev5320.5.0a5.dev5350.5.0a5.dev5360.5.0a5.dev537 Show 41 moreShow less0.5.0a5.dev5390.5.0a5.dev5400.5.0a5.dev5450.5.0a5.dev5620.5.0a5.dev5640.5.0a5.dev5650.5.0a6.dev5700.5.0a6.dev5780.5.0a6.dev5870.5.0a7.dev5960.5.0a8.dev6020.5.0a9.dev6150.5.0a9.dev6290.5.0a9.dev6320.5.0a9.dev6410.5.0a9.dev6430.5.0a9.dev6550.5.0a9.dev8060.5.0b1.dev10.5.0b1.dev20.5.0b1.dev30.5.0b1.dev40.5.0b1.dev50.5.0b2.dev100.5.0b2.dev110.5.0b2.dev120.5.0b2.dev90.5.0b3.dev130.5.0b3.dev140.5.0b3.dev170.5.0b3.dev180.5.0b3.dev190.5.0b3.dev200.5.0b3.dev210.5.0b3.dev220.5.0b3.dev240.5.0b3.dev260.5.0b3.dev270.5.0b3.dev280.5.0b3.dev290.5.0b3.dev30 |
0.5.0b3.dev31 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE) | 2023-06-14 |
| Metasploit | pyLoad js2py Python Execution | 2023-01-13 |
| Nuclei | PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE) | |
| PoC in GitHub | S4MY9/CVE-2023-0297 | 2024-10-04 |
| PoC in GitHub | Small-ears/CVE-2023-0297 | 2023-02-15 |
| PoC in GitHub | bAuh0lz/CVE-2023-0297_Pre-auth_RCE_in_pyLoad | 2023-01-09 |
| PoC in GitHub | btar1gan/exploit_CVE-2023-0297 | 2024-09-15 |
| PoC in GitHub | ferralon-demo/pyload-js2py-rce | 2026-10-07 |
| PoC in GitHub | hazeyez/CVE-2023-0297 | 2023-05-21 |
| PoC in GitHub | overgrowncarrot1/CVE-2023-0297 | 2023-06-15 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, Metasploit, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-0297 is a critical vulnerability (CVSS 9.8) in Pyload, published January 14, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 95.9%, the 99th percentile. Fixed in pyload-ng 0.5.0b3.dev31.
References
huntr.dev/bounties/3fd606f7-83e1-4265-b083-2e1889a05e65
github.com/pyload/pyload/commit/7d73ba7919e594d783b3411d7ddb87885aea782d
packetstormsecurity.com/files/171096/pyLoad-js2py-Python-Execution.html
nvd.nist.gov/vuln/detail/CVE-2023-0297
pypi.org/project/pyload-ng