CVE-2025-61773: XSS in pyLoad-ng Web Interface

An attacker can exploit this XSS vulnerability by crafting malicious payloads and submitting them through the Captcha script endpoint or the Click'N'Load Blueprint. The lack of proper input validation allows these payloads to be processed unsafely, injecting arbitrary content into the web UI. This injected content can then execute client-side scripts, potentially stealing user cookies, redirecting users to phishing sites, or defacing the pyLoad-ng web interface. The impact extends beyond simple defacement; an attacker could leverage this vulnerability to gain persistent access to the system if they can execute malicious code within the context of a legitimate user's session. The potential for lateral movement depends on the privileges of the user account accessing the vulnerable pyLoad-ng instance, but the blast radius could be significant if the system is part of a larger network.

1. Reserved2025-09-30
2. Published2025-10-09
3. Modified2025-10-13
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-61773 is to upgrade pyLoad-ng to version 0.5.0b3.dev91 or later, which contains the necessary input validation fixes. If an immediate upgrade is not feasible due to compatibility issues or system downtime constraints, consider implementing temporary workarounds. These may include restricting access to the Captcha script endpoint and Click'N'Load Blueprint to trusted users only. Web application firewalls (WAFs) can be configured to filter out potentially malicious input based on known XSS patterns. Regularly review and sanitize user input within the pyLoad-ng web interface to prevent future vulnerabilities. After upgrading, confirm the fix by attempting to submit a known malicious payload through the Captcha script endpoint and verifying that it is properly sanitized and does not execute.