CVE-2024-21645: pyload-ng Log Injection Vulnerability
Summary
CVE-2024-21645: pyload Log Injection vulnerability. Affects pyload-ng versions < 0.5.0b3.dev77. Fixed in 0.5.0b3.dev77. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyload-ng is an open-source download manager written in Python. It allows users to easily download files from various sources. The vulnerability in pyload-ng allows unauthenticated actors to inject arbitrary messages into the logs generated by the application.
Vulnerability Detail
The vulnerability arises from the improper handling of newlines in the log entries of pyload-ng. When attempting to sign in with faulty credentials, pyload-ng generates a log entry in the form of 'Login failed for user 'USERNAME''. However, if a username containing a newline character is supplied, the newline is not properly escaped. Since newlines also act as delimiters between log entries, an attacker can exploit this to inject new log entries into the log file. This log injection can be used to forge or manipulate log files, potentially covering an attacker's tracks or implicating innocent parties.
How To Fix
Latest published version: 0.5.0b3.dev101 as of 23 Oct 2026
pip install --upgrade "pyload-ng==0.5.0b3.dev101"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.0b3.dev77
This is the first release that contains the fix.
pip install --upgrade "pyload-ng==0.5.0b3.dev77"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to sanitize user input by properly escaping newline characters before logging them. This can be done by modifying the code responsible for logging user input.
Conclusion
The log injection vulnerability in pyload-ng can be mitigated by upgrading to the latest version or implementing the provided workaround. It is important to address this vulnerability to prevent the manipulation or forgery of log files. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyload-ng →
FAQ
pyload-ng is an open-source download manager written in Python. It provides a convenient way to download files from various sources.
The vulnerability allows unauthenticated attackers to inject arbitrary log entries into the log file. This can be used to manipulate or forge log files, potentially covering an attacker's tracks or implicating innocent parties.
To fix this vulnerability, it is recommended to upgrade to pyload-ng version 0.5.0b3.dev77 or later.
If upgrading to the latest version is not immediately feasible, a temporary workaround is to sanitize user input by properly escaping newline characters before logging them.
There is a proof-of-concept exploit available that demonstrates the log injection vulnerability in pyload-ng. It allows an unauthenticated attacker to inject arbitrary log entries.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyload-ng.
