{"id":"CVE-2023-0297","aliases":["EUVD-2023-0517","GHSA-pf38-5p22-x6h6","PYSEC-2026-498"],"status":"published","title":"Code Injection in pyload/pyload","description":"Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.95915,"percentile":0.99875,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-94"],"published":"2023-01-14T00:00:00Z","modified":"2026-10-28T02:30:59Z","exploits":[{"source":"exploitdb","id":"EDB-51532","title":"PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)","type":"webapps","platform":"python","date":"2023-06-14","verified":true,"url":"https://www.exploit-db.com/exploits/51532"},{"source":"metasploit","id":"exploit/linux/http/pyload_js2py_exec","title":"pyLoad js2py Python Execution","type":"exploit","platform":"Linux,Python,Unix","date":"2023-01-13","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/pyload_js2py_exec"},{"source":"nuclei","id":"CVE-2023-0297","title":"PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0297.yaml"},{"source":"pocgithub","id":"S4MY9/CVE-2023-0297","title":"S4MY9/CVE-2023-0297","date":"2024-10-04","url":"https://github.com/S4MY9/CVE-2023-0297"},{"source":"pocgithub","id":"Small-ears/CVE-2023-0297","title":"Small-ears/CVE-2023-0297","date":"2023-02-15","url":"https://github.com/Small-ears/CVE-2023-0297"},{"source":"pocgithub","id":"bAuh0lz/CVE-2023-0297_Pre-auth_RCE_in_pyLoad","title":"bAuh0lz/CVE-2023-0297_Pre-auth_RCE_in_pyLoad","date":"2023-01-09","url":"https://github.com/bAuh0lz/CVE-2023-0297_Pre-auth_RCE_in_pyLoad"},{"source":"pocgithub","id":"btar1gan/exploit_CVE-2023-0297","title":"btar1gan/exploit_CVE-2023-0297","date":"2024-09-15","url":"https://github.com/btar1gan/exploit_CVE-2023-0297"},{"source":"pocgithub","id":"ferralon-demo/pyload-js2py-rce","title":"ferralon-demo/pyload-js2py-rce","date":"2026-10-07","url":"https://github.com/ferralon-demo/pyload-js2py-rce"},{"source":"pocgithub","id":"hazeyez/CVE-2023-0297","title":"hazeyez/CVE-2023-0297","date":"2023-05-21","url":"https://github.com/hazeyez/CVE-2023-0297"},{"source":"pocgithub","id":"overgrowncarrot1/CVE-2023-0297","title":"overgrowncarrot1/CVE-2023-0297","date":"2023-06-15","url":"https://github.com/overgrowncarrot1/CVE-2023-0297"}],"fixes":[{"ecosystem":"PyPI","package":"pyload-ng","fixed_in":["0.5.0b3.dev31"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pyload-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0b3.dev31"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pyload-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0b3.dev31"}]}],"versions":["0.5.0a5.dev528","0.5.0a5.dev532","0.5.0a5.dev535","0.5.0a5.dev536","0.5.0a5.dev537","0.5.0a5.dev539","0.5.0a5.dev540","0.5.0a5.dev545","0.5.0a5.dev562","0.5.0a5.dev564","0.5.0a5.dev565","0.5.0a6.dev570","0.5.0a6.dev578","0.5.0a6.dev587","0.5.0a7.dev596","0.5.0a8.dev602","0.5.0a9.dev615","0.5.0a9.dev629","0.5.0a9.dev632","0.5.0a9.dev641","0.5.0a9.dev643","0.5.0a9.dev655","0.5.0a9.dev806","0.5.0b1.dev1","0.5.0b1.dev2","0.5.0b1.dev3","0.5.0b1.dev4","0.5.0b1.dev5","0.5.0b2.dev10","0.5.0b2.dev11","0.5.0b2.dev12","0.5.0b2.dev9","0.5.0b3.dev13","0.5.0b3.dev14","0.5.0b3.dev17","0.5.0b3.dev18","0.5.0b3.dev19","0.5.0b3.dev20","0.5.0b3.dev21","0.5.0b3.dev22","0.5.0b3.dev24","0.5.0b3.dev26","0.5.0b3.dev27","0.5.0b3.dev28","0.5.0b3.dev29","0.5.0b3.dev30"]},{"source":"osv","ecosystem":"PyPI","package":"pyload-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0b3.dev31"}]}],"versions":["0.5.0a5.dev528","0.5.0a5.dev532","0.5.0a5.dev535","0.5.0a5.dev536","0.5.0a5.dev537","0.5.0a5.dev539","0.5.0a5.dev540","0.5.0a5.dev545","0.5.0a5.dev562","0.5.0a5.dev564","0.5.0a5.dev565","0.5.0a6.dev570","0.5.0a6.dev578","0.5.0a6.dev587","0.5.0a7.dev596","0.5.0a8.dev602","0.5.0a9.dev615","0.5.0a9.dev629","0.5.0a9.dev632","0.5.0a9.dev641","0.5.0a9.dev643","0.5.0a9.dev655","0.5.0a9.dev806","0.5.0b1.dev1","0.5.0b1.dev2","0.5.0b1.dev3","0.5.0b1.dev4","0.5.0b1.dev5","0.5.0b2.dev10","0.5.0b2.dev11","0.5.0b2.dev12","0.5.0b2.dev9","0.5.0b3.dev13","0.5.0b3.dev14","0.5.0b3.dev17","0.5.0b3.dev18","0.5.0b3.dev19","0.5.0b3.dev20","0.5.0b3.dev21","0.5.0b3.dev22","0.5.0b3.dev24","0.5.0b3.dev26","0.5.0b3.dev27","0.5.0b3.dev28","0.5.0b3.dev29","0.5.0b3.dev30"]}],"products":[{"vendor":"pyload","product":"pyload"},{"vendor":"pyload","product":"pyload/pyload"}],"references":[{"url":"https://huntr.dev/bounties/3fd606f7-83e1-4265-b083-2e1889a05e65","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://github.com/pyload/pyload/commit/7d73ba7919e594d783b3411d7ddb87885aea782d","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"http://packetstormsecurity.com/files/171096/pyLoad-js2py-Python-Execution.html","tags":["x_transferred","web"]},{"url":"http://packetstormsecurity.com/files/172914/PyLoad-0.5.0-Remote-Code-Execution.html","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0297","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pf38-5p22-x6h6","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0297.json","tags":["advisory"]},{"url":"https://pypi.org/project/pyload-ng","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-0297","title":" Code Injection in pyload/pyload","description":"Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.","status":"published","published":"2023-01-14T00:00:00Z","modified":"2025-04-07T18:41:55.8Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:35:35.580545Z"}],"euvd":[{"id":"EUVD-2023-0517","description":"Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.","status":"published","published":"2023-01-14T00:00:00Z","modified":"2025-04-07T18:41:55Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:52:40.600826Z"}],"ghsa":[{"id":"GHSA-pf38-5p22-x6h6","title":"Code Injection in pyload-ng","description":"Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.","status":"published","published":"2023-01-14T03:30:21Z","modified":"2023-06-16T17:47:26Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:36:55.184601Z"}],"nvd":[{"id":"CVE-2023-0297","description":"Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.","status":"published","published":"2023-01-14T03:15:18.8Z","modified":"2026-06-17T05:25:14.073Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:07:45.305824Z"}],"osv":[{"id":"CVE-2023-0297","title":" Code Injection in pyload/pyload","description":"Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.","status":"published","published":"2023-01-14T00:00:00Z","modified":"2026-10-28T02:30:59.1925264Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:44:29.487253Z"},{"id":"GHSA-pf38-5p22-x6h6","title":"Code Injection in pyload-ng","description":"Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.","status":"published","published":"2023-01-14T03:30:21Z","modified":"2026-06-29T12:26:35.075568626Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:52.891208Z"},{"id":"PYSEC-2026-498","title":"Code Injection in pyload-ng","description":"Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.","status":"published","published":"2026-06-29T11:50:44.189733Z","modified":"2026-07-01T20:23:02.943788Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:57.671918Z"}]}}