Is CVE-2026-45348 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45348 being exploited in the wild.

How severe is CVE-2026-45348?

High severity, with a CVSS score of 8.7, published 28 May 2026.

Which products and versions are affected?

pyLoad Next Generation < 0.5.0b3.dev100, <= 0.5.0b3.dev99; pyload-ng (PyPI) <= 0.5.0b3.dev99, ECOSYSTEM:introduced=0,last_affected=0.5.0b3.dev99.

Is there a fix for CVE-2026-45348?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-45348 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-45348?

Check whether you run pyLoad Next Generation or pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45348: pyLoad stored XSS in Downloads view via packages.js template

Q: Is there a fix for CVE-2026-45348?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-45348 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-45348?

Check whether you run pyLoad Next Generation or pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45348 · Severity: high · CVSS 8.7 · Published 2026-05-28

pyLoad is a download manager that allows users to queue and manage file downloads. A security flaw in its web interface allows an attacker to inject malicious scripts into the 'Downloads' view. If an administrator views the list of downloads, the attacker can steal their session cookies, potentially leading to full control over the pyLoad server and the underlying system.

Technologies: pyLoad Next Generation, pyload-ng (PyPI). Vendors: pyLoad, PyPI.

Quick answers

Is CVE-2026-45348 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45348 being exploited in the wild.
How severe is CVE-2026-45348?: High severity, with a CVSS score of 8.7, published 28 May 2026.
Which products and versions are affected?: pyLoad Next Generation < 0.5.0b3.dev100, <= 0.5.0b3.dev99; pyload-ng (PyPI) <= 0.5.0b3.dev99, ECOSYSTEM:introduced=0,last_affected=0.5.0b3.dev99.
Is there a fix for CVE-2026-45348?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-45348 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45348?: Check whether you run pyLoad Next Generation or pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in pyLoad's 'modern' theme. The 'packages.js' template literal interpolates several fields from the 'link' object (including url, name, and statusmsg) directly into HTML without escaping, subsequently rendering them via jQuery's .html() method. An authenticated attacker with 'Perms.ADD' privileges can submit a malicious URL containing a single quote and an event handler (e.g., onmouseover) to execute arbitrary JavaScript in the context of other users' browsers. Additionally, if the ClickNLoad handler is enabled, unauthenticated attackers can trigger this via the /flash/add endpoint. This can lead to session hijacking and remote code execution via administrative configuration changes.

Affected products

pyLoad pyload-ng <= 0.5.0b3.dev99

Identifiers

CVE-2026-45348
GHSA-fcjq-435v-jx94
PYSEC-2026-2994

Timeline

2026-05-14: advisory: GitHub Advisory published
2026-05-28: other: NVD published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.