CVE-2023-0434
Improper Input Validation in pyload/pyload
CVE-2023-0434 is a medium vulnerability (CVSS 5.4) in Pyload, published January 22, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.85%, the 58th percentile. Fixed in pyload-ng 0.5.0b3.dev40.
Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.
Attack profile
How easy it is to exploit
- Attack vector
- Physical
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Improper Input Validation in pyload/pyload
Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.
- Record
CVE-2023-0434- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:P/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2023-0587
Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.
- Record
EUVD-2023-0587- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:P/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-x9vc-5q77-m7x4
Improper Input Validation in pyload-ng
Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.
- Record
GHSA-x9vc-5q77-m7x4- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:P/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.
- Record
CVE-2023-0434- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:P/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Improper Input Validation in pyload/pyload
Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.
- Record
CVE-2023-0434- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:P/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-x9vc-5q77-m7x4
Improper Input Validation in pyload-ng
Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.
- Record
GHSA-x9vc-5q77-m7x4- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:P/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVPYSEC-2026-908
Improper Input Validation in pyload-ng
Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.
- Record
PYSEC-2026-908- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:P/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pyload-ngPyPI |
before 0.5.0b3.dev40 | 0.5.0b3.dev40 |
pyload-ngPyPI |
before 0.5.0b3.dev40, plus listed versions 0.5.0a5.dev5280.5.0a5.dev5320.5.0a5.dev5350.5.0a5.dev5360.5.0a5.dev537 Show 45 moreShow less0.5.0a5.dev5390.5.0a5.dev5400.5.0a5.dev5450.5.0a5.dev5620.5.0a5.dev5640.5.0a5.dev5650.5.0a6.dev5700.5.0a6.dev5780.5.0a6.dev5870.5.0a7.dev5960.5.0a8.dev6020.5.0a9.dev6150.5.0a9.dev6290.5.0a9.dev6320.5.0a9.dev6410.5.0a9.dev6430.5.0a9.dev6550.5.0a9.dev8060.5.0b1.dev10.5.0b1.dev20.5.0b1.dev30.5.0b1.dev40.5.0b1.dev50.5.0b2.dev100.5.0b2.dev110.5.0b2.dev120.5.0b2.dev90.5.0b3.dev130.5.0b3.dev140.5.0b3.dev170.5.0b3.dev180.5.0b3.dev190.5.0b3.dev200.5.0b3.dev210.5.0b3.dev220.5.0b3.dev240.5.0b3.dev260.5.0b3.dev270.5.0b3.dev280.5.0b3.dev290.5.0b3.dev300.5.0b3.dev310.5.0b3.dev320.5.0b3.dev330.5.0b3.dev34 |
0.5.0b3.dev40 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
huntr.dev/bounties/7d9332d8-6997-483b-9fb9-bcf2ae01dad4
github.com/pyload/pyload/commit/a2b1eb1028f45ac58dea5f58593c1d3db2b4a104
nvd.nist.gov/vuln/detail/CVE-2023-0434
pypi.org/project/pyload-ng
Left out here: 3 versions. The JSON record has them.