# CVE-2026-45348: pyLoad stored XSS in Downloads view via packages.js template

Source: https://junglewise.ai/threats/cve-2026-45348-pyload-stored-xss-in-downloads-view-via-packages-js-template  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-45348 · Severity: high · CVSS 8.7 · Published 2026-05-28

pyLoad is a download manager that allows users to queue and manage file downloads. A security flaw in its web interface allows an attacker to inject malicious scripts into the 'Downloads' view. If an administrator views the list of downloads, the attacker can steal their session cookies, potentially leading to full control over the pyLoad server and the underlying system.

Technologies: [pyLoad Next Generation](https://junglewise.ai/threats/technologies/pyload-next-generation), [pyload-ng (PyPI)](https://junglewise.ai/threats/technologies/pyload-ng). Vendors: [pyLoad](https://junglewise.ai/threats/vendors/pyload), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-45348 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45348 being exploited in the wild.

**How severe is CVE-2026-45348?** High severity, with a CVSS score of 8.7, published 28 May 2026.

**Which products and versions are affected?** pyLoad Next Generation < 0.5.0b3.dev100, <= 0.5.0b3.dev99; pyload-ng (PyPI) <= 0.5.0b3.dev99, ECOSYSTEM:introduced=0,last_affected=0.5.0b3.dev99.

**Is there a fix for CVE-2026-45348?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-45348 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-45348?** Check whether you run pyLoad Next Generation or pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in pyLoad's 'modern' theme. The 'packages.js' template literal interpolates several fields from the 'link' object (including url, name, and statusmsg) directly into HTML without escaping, subsequently rendering them via jQuery's .html() method. An authenticated attacker with 'Perms.ADD' privileges can submit a malicious URL containing a single quote and an event handler (e.g., onmouseover) to execute arbitrary JavaScript in the context of other users' browsers. Additionally, if the ClickNLoad handler is enabled, unauthenticated attackers can trigger this via the /flash/add endpoint. This can lead to session hijacking and remote code execution via administrative configuration changes.

## Affected products

- pyLoad pyload-ng <= 0.5.0b3.dev99

## Identifiers

- CVE-2026-45348
- GHSA-fcjq-435v-jx94
- PYSEC-2026-2994

## Timeline

- 2026-05-14: advisory: GitHub Advisory published
- 2026-05-28: other: NVD published

## References

- [https://api.github.com/users/adrgs](https://api.github.com/users/adrgs)
- [https://github.com/adrgs](https://github.com/adrgs)
- [https://api.github.com/users/adrgs/gists%7B/gist_id%7D](https://api.github.com/users/adrgs/gists%7B/gist_id%7D)
- [https://api.github.com/users/adrgs/repos](https://api.github.com/users/adrgs/repos)
- [https://avatars.githubusercontent.com/u/11564377?v=4](https://avatars.githubusercontent.com/u/11564377?v=4)
- [https://api.github.com/users/adrgs/events%7B/privacy%7D](https://api.github.com/users/adrgs/events%7B/privacy%7D)

## Related threats

- [pyLoad unauthenticated template access and information disclosure](https://junglewise.ai/threats/cve-2026-75597-pyload-unauthenticated-access-to-web-path-filename-bypasses)
- [pyLoad API denial of service in multipart file upload handling](https://junglewise.ai/threats/cve-2026-48484-pyload-lack-of-input-size-validation-leads-to-denial-of-service)
- [pyload-ng authentication bypass in getUserData/get_userdata](https://junglewise.ai/threats/pyload-ng-getuserdata-get-userdata-exposed-at-perms-any-allow-any-cd197c9d)
- [pyLoad rate-limit bypass and audit-log spoofing via X-Forwarded-For header](https://junglewise.ai/threats/pyload-rate-limit-bypass-and-audit-log-spoofing-via-trusted-client-0df0fd12)
- [pyLoad session invalidation bypass in privilege revocation and password change](https://junglewise.ai/threats/pyload-privilege-revocation-and-password-change-through-the-rest-api-do-8e7301ba)