CVE-2026-45348: pyLoad: Stored XSS in Downloads view via unsanitized link URL in packages.js template literal

Synopsis

Stored cross-site scripting (XSS) in pyLoad's download manager allows a low-privileged attacker to inject arbitrary JavaScript into the downloads view. The vulnerability is reachable over the network and requires only a low-privilege account to plant the malicious payload; a separate victim (such as an operator) must then open the downloads view in their browser to trigger execution. Successful exploitation gives the attacker full script execution in the victim's browser session, enabling credential theft, session hijacking, and unauthorized actions on behalf of the victim. No fix version has been published upstream; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the pyLoad web interface over the network to submit a malicious package link.

• AuthenticationRequired

  Any low-privilege account with permission to submit package links is sufficient; no administrative credentials are needed.

• Victim interactionRequired

  A separate victim (such as a pyLoad operator) must open the downloads view in their browser to trigger execution of the injected script.

• Attack complexityDetail

  Exploitation is reliable and condition-free; breaking out of the HTML attribute requires only standard quoting and no special environmental factors.

Blast Radius

• The injected script executes in the victim operator's browser session, giving the attacker access to session tokens and authentication cookies for that user.
• The attacker can read any data visible in the pyLoad web UI under the victim's account, including package contents, links, and configuration.
• The attacker can perform any action the victim operator is authorized to take, including adding, modifying, or deleting download packages and links.