pyLoad is vulnerable to stored XSS in Downloads view via unsanitized link URL in packages.js template literal
Date: 2026-05
Affected: pip/pyload-ng
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-45348
CWE: CWE-79
CVSS: 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)

## Summary The `packages.js` template at `src/pyload/webui/app/themes/modern/templates/js/packages.js:172` interpolates a stored link URL into a template literal inside single-quoted HTML and then writes the result to the DOM via `$(div).html(html)`. No escaping runs between the API value and `innerHTML`. An attacker (Alice) who can submit a package link puts a single quote plus event handler into the URL, breaks out of the attribute, and executes JavaScript in every operator's browser that opens the downloads view. The theme does not set a Content Security Policy that restricts inline script or event handlers. ## Details **Sink**: `src/pyload/webui/app/themes/modern/templates/js/packages.js:165-188`: ```javascript const html = ` <span class='child_status'> <span style='margin-right: 2px;color: #337ab7;' class='${link.icon}'></span> </span> <span style='font-size: 16px; font-weight: bold;'> <a onclick='return false' href='${link.url}'>${link.name}</a> </span><br/> <div class='child_secrow' ...> <span class='child_status' ...>${link.statusmsg}</span>&nbsp;${link.error}&nbsp; <span class='child_status' ...>${link.format_size}</span> <span class='child_status' ...> ${link.plugin}</span>... </div>`; const div = document.createElement("div"); $(div).attr("id", `file_${link.id}`); $(div).css("padding-left", "30px"); $(div).css("cursor", "grab"); $(div).addClass("child"); $(div).html(html); ``` `link.url` flows in from `/ap


Mitigations:

Architectural layers (MAESTRO):