CVE-2024-1240: Open Redirection Vulnerability in pyload-ng 0.5.0
Summary
CVE-2024-1240: An open redirection vulnerability exists in pyload/pyload version 0.5.0. Affects pyload-ng versions < fe94451dcc2be90b3889e2fd9d07b483c8a6dccd. Fixed in fe94451dcc2be90b3889e2fd9d07b483c8a6dccd. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyload-ng is an open-source download manager that allows users to manage and automate the downloading of files from various sources. It is designed to be lightweight and efficient, providing features such as support for multiple file hosting services, a web interface, and plugin capabilities. However, version 0.5.0 of pyload-ng is susceptible to an open redirection vulnerability, which can be exploited to redirect users to malicious websites.
Vulnerability Detail
An open redirection vulnerability exists in pyload-ng version 0.5.0 due to improper handling of the 'next' parameter in the login functionality. This flaw allows attackers to craft URLs that redirect users to external sites, potentially leading to phishing attacks or other malicious activities. The vulnerability arises from a lack of validation on the redirect URL, enabling unauthorized redirection to any specified address.
How To Fix
Latest published version: 0.5.0b3.dev101 as of 23 Oct 2026
pip install --upgrade "pyload-ng==0.5.0b3.dev101"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
fe94451dcc2be90b3889e2fd9d07b483c8a6dccd
This is the first release that contains the fix.
pip install --upgrade "pyload-ng==fe94451dcc2be90b3889e2fd9d07b483c8a6dccd"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the login functionality that utilizes the 'next' parameter until they have updated to the patched version. Additionally, implementing URL validation on the server-side can help mitigate the risk of open redirection.
Conclusion
The open redirection vulnerability in pyload-ng version 0.5.0 poses a significant risk as it allows attackers to redirect users to malicious sites. It is crucial for users to update to the patched version to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for pyload-ng →
FAQ
An open redirection vulnerability allows attackers to redirect users to external sites without their consent, which can be exploited for phishing or other malicious purposes.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without needing to sign up.
If you cannot update the package right away, avoid using the login functionality that relies on the 'next' parameter and consider implementing server-side URL validation as a temporary measure.
The CVSS score for this vulnerability is 6.1, indicating a moderate level of severity.
More information can be found in the advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/pyload-ng/PYSEC-2024-123.yaml.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyload-ng.
