{"cve":"CVE-2025-57751","nvd":{"published":"2025-08-21T19:15:43.227","modified":"2026-06-17T09:43:21.853","status":"Deferred","description":"pyLoad is the free and open-source Download Manager written in pure Python. The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of jk parameter verification, the jk parameter input by the user is directly determined as dykpy.evaljs(), resulting in the server CPU being fully occupied and the web-ui becoming unresponsive. This vulnerability is fixed in 0.5.0b3.dev92.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","score":7.7},"cvss_v3":null,"cwes":["CWE-400"],"references":["https://github.com/pyload/pyload/security/advisories/GHSA-9gjj-6gj7-c4wj"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:07:46.309729541+00:00"},"epss":{"cve":"CVE-2025-57751","score":0.00325,"percentile":0.25583,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-9gjj-6gj7-c4wj","url":"https://osv.dev/vulnerability/GHSA-9gjj-6gj7-c4wj","summary":"Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs","modified":"2026-07-07T17:57:26.488115427Z","packages":[{"ecosystem":"PyPI","name":"pyload-ng","purl":"pkg:pypi/pyload-ng","ranges":["<0.5.0b3.dev92"],"fixed":["0.5.0b3.dev92"]}]},{"id":"PYSEC-2026-1815","url":"https://osv.dev/vulnerability/PYSEC-2026-1815","summary":"Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs","modified":"2026-07-07T17:48:03.573296956Z","packages":[{"ecosystem":"PyPI","name":"pyload-ng","purl":"pkg:pypi/pyload-ng","ranges":["<0.5.0b3.dev92"],"fixed":["0.5.0b3.dev92"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}