High · 8.7 CVE-2025-7346 EUVD-2025-20395GHSA-x698-5hjm-w2m5PYSEC-2026-1822

pyLoad is vulnerable to attacks that bypass localhost restrictions, enabling the creation of arbitrary packages

Published Jul 8, 2025 · Updated Jul 8, 2025 · Assigned by Toreon

Description

Any unauthenticated attacker can bypass the localhost
restrictions posed by the application and utilize this to create
arbitrary packages

Vendor	Product	Affected	Fixed
Pyload	Pyload	≤ 0.5.0b3.dev77	—

Ecosystem	Package	Affected	Fixed	Record
PyPI	pyload-ng	<= 0.5.0b3.dev88	—	GHSA-x698-5hjm-w2m5