pyLoad vulnerable to XSS through insecure CAPTCHA

The impact of CVE-2025-53890 is severe due to its unauthenticated nature and potential for complete system compromise. An attacker can inject malicious JavaScript code through the CAPTCHA result, which is then directly evaluated by the onCaptchaResult() function. This allows them to steal user session cookies, hijack accounts, and potentially execute arbitrary commands on the server if the application has sufficient privileges. The direct evaluation of attacker-controlled input without sanitization is the root cause, mirroring the dangers of similar XSS vulnerabilities where malicious scripts can be injected and executed.

Organizations utilizing pyLoad-ng for media downloading and management, particularly those with publicly accessible CAPTCHA endpoints, are at significant risk. Environments with legacy configurations or those lacking robust input validation practices are especially vulnerable. Shared hosting environments where multiple users share the same pyLoad-ng instance are also at increased risk.

• python / server: Monitor pyLoad-ng logs for unusual activity or errors related to CAPTCHA processing. Look for suspicious JavaScript code being passed as CAPTCHA results.

grep -i 'eval' /var/log/pyload-ng/error.log

• generic web: Use curl or wget to test CAPTCHA endpoints with payloads containing JavaScript code. Examine the response for signs of script execution (e.g., an alert box).

curl -X POST -d 'result=<script>alert("XSS")</script>' <pyload-ng_captcha_endpoint>

1. 2025-07-15Disclosure

   disclosure

1. आरक्षित2025-07-11
2. प्रकाशित2025-07-15
3. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2025-53890 is to immediately upgrade pyLoad-ng to version 0.20 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious JavaScript code in the CAPTCHA result. Additionally, carefully review and sanitize all user-supplied input before rendering it in the browser. Implement strict Content Security Policy (CSP) headers to restrict the sources from which scripts can be executed, limiting the impact of a successful XSS attack. After upgrading, confirm the fix by attempting to submit a CAPTCHA result containing a simple JavaScript payload (e.g., alert('XSS')) and verifying that it is not executed.