CVE-2023-0297: Code Injection Vulnerability in pyload-ng
Summary
CVE-2023-0297: Code Injection in pyload-ng. Affects pyload-ng versions < 0.5.0b3.dev31. Fixed in 0.5.0b3.dev31. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyload-ng is an open-source download manager that allows users to manage and automate the downloading of files from various sources. It is designed to be lightweight and efficient, providing features such as support for multiple file hosting services, a web interface, and plugin capabilities. However, prior to version 0.5.0b3.dev31, pyload-ng was susceptible to a code injection vulnerability that could be exploited by attackers.
Vulnerability Detail
The vulnerability, identified as CVE-2023-0297, arises from improper handling of user input within the pyload-ng application. This flaw allows an attacker to inject malicious code, which could be executed in the context of the application. The ramifications of this vulnerability are severe, as it could lead to unauthorized access, data manipulation, or even complete system compromise. The vulnerability has a CVSS score of 9.8, indicating a critical level of severity.
How To Fix
Latest published version: 0.5.0b3.dev101 as of 23 Oct 2026
pip install --upgrade "pyload-ng==0.5.0b3.dev101"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.0b3.dev31
This is the first release that contains the fix.
pip install --upgrade "pyload-ng==0.5.0b3.dev31"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users are advised to restrict access to the application and validate all user inputs rigorously to mitigate the risk of exploitation until the package can be updated.
Conclusion
In summary, CVE-2023-0297 represents a critical code injection vulnerability in pyload-ng that can have severe consequences if exploited. Users are strongly encouraged to update to the latest version to mitigate risks. Additionally, utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for pyload-ng →
FAQ
CVE-2023-0297 is a code injection vulnerability found in pyload-ng that allows attackers to execute arbitrary code.
If you are using a version prior to 0.5.0b3.dev31, your installation is vulnerable to this issue.
Exploitation of this vulnerability could lead to unauthorized access, data loss, or complete system compromise.
You can update pyload-ng by running the command 'pip install --upgrade pyload-ng' in your terminal.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software without requiring code access.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyload-ng.
