CVE-2025-57751: Denial-of-Service Vulnerability in pyload-ng due to Unverified Parameter Handling
Summary
CVE-2025-57751: Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs. Affects pyload-ng versions < 0.5.0b3.dev92. Fixed in 0.5.0b3.dev92. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyload-ng is an open-source download manager written in Python, designed to manage and automate the downloading of files from various sources. It supports multiple protocols and provides a web-based interface for user interaction. However, it has been found to be vulnerable to a Denial-of-Service (DoS) attack due to improper handling of user input in its CNL Blueprint functionality.
Vulnerability Detail
The vulnerability arises from the lack of verification for the 'jk' parameter in the 'addcrypted2' endpoint of the pyload-ng application. When a user submits a crafted 'jk' parameter, it is directly evaluated using the dukpy.evaljs() function, which can lead to excessive CPU usage. This can render the web interface unresponsive and exhaust system resources, causing service interruptions for legitimate users. The affected code is located in the cnl_blueprint.py file, where the 'jk' parameter is processed without any validation.
How To Fix
Latest published version: 0.5.0b3.dev101 as of 23 Oct 2026
pip install --upgrade "pyload-ng==0.5.0b3.dev101"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.0b3.dev92
This is the first release that contains the fix.
pip install --upgrade "pyload-ng==0.5.0b3.dev92"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement input validation for the 'jk' parameter before it is processed. For example, you can modify the code to check for valid input or limit the execution time of the evaluated script to prevent resource exhaustion.
Conclusion
The CVE-2025-57751 vulnerability in pyload-ng poses a significant risk by allowing Denial-of-Service attacks through unverified parameter handling. Users are encouraged to update to the latest version to protect their systems and ensure continued service availability.
See every vulnerability recorded for pyload-ng →
FAQ
CVE-2025-57751 is a vulnerability in the pyload-ng package that allows for a Denial-of-Service attack due to unverified handling of the 'jk' parameter.
Exploitation of this vulnerability can lead to excessive CPU usage, making the web interface unresponsive and causing service interruptions.
You should update to version 0.5.0b3.dev92 or later to mitigate the vulnerability.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Vulert is a monitoring tool that uses Pipfile.lock to alert users in real-time about open-source vulnerabilities in their software.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyload-ng.
