Executive Summary

CVE-2026-45348 is a stored cross-site scripting (XSS) vulnerability in the pyload-ng package, affecting versions up to 0.5.0. The issue occurs because user-submitted package link URLs are inserted into a JavaScript template without proper escaping. This allows an attacker with permission to add packages to inject malicious JavaScript code by including event handlers in the URL.

When an administrator or other user views the Downloads page, the injected script executes in their browser, potentially stealing session cookies or performing other malicious actions. The vulnerability is persistent and does not require further interaction beyond visiting the affected page.

The root cause is the lack of HTML escaping in the template and the absence of a Content Security Policy that restricts inline scripts or event handlers.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized code execution in the browsers of users who view the affected Downloads page.

• An attacker can steal session cookies, potentially hijacking user sessions.
• Malicious scripts could perform actions on behalf of the user, leading to data theft or manipulation.
• If an administrator's session is compromised, it could lead to remote code execution or further system compromise.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for the presence of malicious JavaScript code injected into the Downloads page of pyLoad, specifically in the package link URLs that are rendered without proper escaping.

Since the attack involves stored cross-site scripting (XSS), detection involves inspecting the HTML content of the Downloads page (e.g., /collector or /queue) for suspicious event handlers or script injections in package links.

You can also monitor HTTP traffic to the Downloads page for unusual script tags or event handlers embedded in URLs.

• Use browser developer tools to inspect the DOM elements on the Downloads page for injected event handlers like 'onmouseover' in package links.
• Run a command-line HTTP request to fetch the Downloads page and grep for suspicious patterns, for example:
• curl -s http://<pyload-server>/collector | grep -E "onmouseover|onerror|onclick"
• Check the pyLoad package database or configuration for any package links containing single quotes or event handler attributes.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation steps include upgrading pyLoad to version 0.5.0b3.dev100 or later, where the vulnerability is fixed.

If upgrading is not immediately possible, restrict user permissions to prevent attackers from submitting malicious package links, specifically limiting users with 'Perms.ADD' privileges.

Implement a strict Content Security Policy (CSP) header that disallows inline scripts and event handlers to reduce the risk of script execution.

Sanitize or escape all user-submitted package link URLs before rendering them in the web interface to prevent injection.

Monitor and audit package submissions for suspicious content and remove any malicious entries.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker to execute malicious JavaScript in the browsers of operators who view the affected downloads page, potentially leading to unauthorized access to sensitive data such as session cookies.

Such unauthorized access and potential data theft can lead to violations of data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and breaches.

The lack of proper input sanitization and absence of a strict Content Security Policy (CSP) contribute to the risk of data exposure, which can result in non-compliance with these standards.

Useful 0 Not Useful 0