CVE-2023-0435

Excessive Attack Surface in pyload/pyload

4.0 MediumFix available

CVE-2023-0435 is a medium vulnerability (CVSS 4.0) in Pyload, published January 22, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.75%, the 54th percentile. Fixed in pyload-ng 0.5.0b3.dev41.

Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

0.75%Down 0.1 points since Jan 23, 2023

What each source reports

CVE List Score used 4.0

Excessive Attack Surface in pyload/pyload

Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41.

Record: CVE-2023-0435
CVSS 3.0: 4.0 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-1125
Updated: 2026-11-02

EUVDEUVD-2023-0366 4.0

Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41.

Record: EUVD-2023-0366
CVSS 3.0: 4.0 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-6jmx-pv77-wm5w 9.8

Excessive Attack Surface in pyload-ng

Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41.

Record: GHSA-6jmx-pv77-wm5w
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-1125
Updated: 2026-11-02

NVD 9.8

Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41.

Record: CVE-2023-0435
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0: 4.0 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-1125
Updated: 2026-11-02

OSV 4.0

Excessive Attack Surface in pyload/pyload

Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41.

Record: CVE-2023-0435
CVSS 3.0: 4.0 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-1125
Updated: 2026-11-02

OSVGHSA-6jmx-pv77-wm5w 9.8

Excessive Attack Surface in pyload-ng

Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41.

Record: GHSA-6jmx-pv77-wm5w
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-1125
Updated: 2026-11-02

OSVPYSEC-2026-494 9.8

Excessive Attack Surface in pyload-ng

Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41.

Record: PYSEC-2026-494
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`pyload-ng` PyPI	before 0.5.0b3.dev41	0.5.0b3.dev41
`pyload-ng` PyPI	before 0.5.0b3.dev41, plus listed versions 0.5.0a5.dev5280.5.0a5.dev5320.5.0a5.dev5350.5.0a5.dev5360.5.0a5.dev537 Show 45 moreShow less 0.5.0a5.dev5390.5.0a5.dev5400.5.0a5.dev5450.5.0a5.dev5620.5.0a5.dev5640.5.0a5.dev5650.5.0a6.dev5700.5.0a6.dev5780.5.0a6.dev5870.5.0a7.dev5960.5.0a8.dev6020.5.0a9.dev6150.5.0a9.dev6290.5.0a9.dev6320.5.0a9.dev6410.5.0a9.dev6430.5.0a9.dev6550.5.0a9.dev8060.5.0b1.dev10.5.0b1.dev20.5.0b1.dev30.5.0b1.dev40.5.0b1.dev50.5.0b2.dev100.5.0b2.dev110.5.0b2.dev120.5.0b2.dev90.5.0b3.dev130.5.0b3.dev140.5.0b3.dev170.5.0b3.dev180.5.0b3.dev190.5.0b3.dev200.5.0b3.dev210.5.0b3.dev220.5.0b3.dev240.5.0b3.dev260.5.0b3.dev270.5.0b3.dev280.5.0b3.dev290.5.0b3.dev300.5.0b3.dev310.5.0b3.dev320.5.0b3.dev330.5.0b3.dev34	0.5.0b3.dev41

History

History
When	Changed	Sources
2026-11-02	created	CVE List, EUVD, GitHub Advisories, NVD, OSV

References

This page doesn't list everything

Left out here: 4 versions. The JSON record has them.