« Volver al listado

CVE-2025-53890

Estado: AplazadaCrítica (9.8)—

pyload is an open-source Download Manager written in pure Python. An unsafe JavaScript evaluation vulnerability in pyLoad’s CAPTCHA processing code allows unauthenticated remote attackers to execute arbitrary code in the client browser and potentially the backend server. Exploitation requires no user interaction or authentication and can result in session hijacking, credential theft, and full system remote code execution. Commit 909e5c97885237530d1264cfceb5555870eb9546, the patch for the issue, is included in version 0.5.0b3.dev89.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

CWE-94 (evaluación insegura de código) en aplicación web expuesta (AV:N, PR:N, UI:N) permite RCE remoto sin autenticación; impactos: ejecución arbitraria de código, robo de credenciales y secuestro de sesión confirmados.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementApplication Developer GuidanceApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareActive Directory Configuration

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Pyload — PyloadAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-53890",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-53890",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-15T13:24:23.757076Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "pyload",
          "product": "pyload",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.5.0b3.dev89"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-07-15T00:15:24.150",
  "references": [
    {
      "url": "https://github.com/pyload/pyload/commit/909e5c97885237530d1264cfceb5555870eb9546",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pyload/pyload/pull/4586",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pyload/pyload/security/advisories/GHSA-8w3f-4r8f-pf53",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pyload/pyload/security/advisories/GHSA-8w3f-4r8f-pf53",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "pyload is an open-source Download Manager written in pure Python. An unsafe JavaScript evaluation vulnerability in pyLoad’s CAPTCHA processing code allows unauthenticated remote attackers to execute arbitrary code in the client browser and potentially the backend server. Exploitation requires no user interaction or authentication and can result in session hijacking, credential theft, and full system remote code execution. Commit 909e5c97885237530d1264cfceb5555870eb9546, the patch for the issue, is included in version 0.5.0b3.dev89."
    },
    {
      "lang": "es",
      "value": "Pyload es un gestor de descargas de código abierto escrito en Python puro. Una vulnerabilidad de evaluación de JavaScript insegura en el código de procesamiento de CAPTCHA de PyLoad permite a atacantes remotos no autenticados ejecutar código arbitrario en el navegador del cliente y, potencialmente, en el servidor backend. Su explotación no requiere interacción ni autenticación del usuario y puede provocar el secuestro de sesión, el robo de credenciales y la ejecución remota de código en todo el sistema. El commit 909e5c97885237530d1264cfceb5555870eb9546, el parche para este problema, está incluido en la versión 0.5.0b3.dev89."
    }
  ],
  "lastModified": "2026-06-17T09:39:05.117",
  "sourceIdentifier": "security-advisories@github.com"
}