CVE-2024-21645: pyload-ng Log Injection Vulnerability
Summary
CVE-2024-21645: pyload Log Injection vulnerability. Affects pyload-ng versions < 0.5.0b3.dev77. Fixed in 0.5.0b3.dev77. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyload-ng is an open-source download manager that allows users to manage and automate the downloading of files from various sources. It is designed to be lightweight and user-friendly, providing features such as support for multiple file hosting services, a web interface, and plugin support. However, it has been identified to have a log injection vulnerability that can be exploited by unauthenticated users.
Vulnerability Detail
A log injection vulnerability exists in pyload-ng, allowing unauthenticated attackers to inject arbitrary messages into the application's logs. This occurs when a user attempts to log in with faulty credentials, and the application fails to properly escape newline characters in the username. As a result, attackers can manipulate log entries, potentially covering their tracks or implicating others in malicious activities.
How To Fix
Latest published version: 0.5.0b3.dev101 as of 23 Oct 2026
pip install --upgrade "pyload-ng==0.5.0b3.dev101"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.0b3.dev77
This is the first release that contains the fix.
pip install --upgrade "pyload-ng==0.5.0b3.dev77"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that your application is not exposed to unauthenticated users, or implement input validation to sanitize usernames before logging them.
Conclusion
The log injection vulnerability in pyload-ng poses a risk to the integrity of log files, allowing attackers to manipulate logs for malicious purposes. It is crucial to update to the latest version to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for pyload-ng →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate level of severity.
Yes, the vulnerability can be exploited by any unauthenticated actor remotely.
Attackers can inject false log entries, which may obscure their activities or falsely implicate other users.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package, implement input validation to sanitize user inputs and restrict access to the application to authenticated users only.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyload-ng.
