PyPI/pyload-ng CVE-2025-55156: high 7.8, EPSS 0.34%

PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter

Action: Upgrade pyload-ng to 0.5.0b3.dev91 or later.

pip install pyload-ng==0.5.0b3.dev91

Affected

Fixed versions

Sources

• osv: PYSEC-2026-1821
• nvd: CVE-2025-55156
• https://github.com/pyload/pyload/security/advisories/GHSA-pwh4-6r3m-j2rf
• https://github.com/pyload/pyload/commit/134edcdf6e2a10c393743c254da3d9d90b74258f
• https://github.com/pyload/pyload
• https://github.com/pyload/pyload/blob/develop/src/pyload/core/database/file_database.py#L271
• https://pypi.org/project/pyload-ng
• https://github.com/advisories/GHSA-pwh4-6r3m-j2rf

CVE-2025-55156 · published 2026-07-07T16:03:00.874481Z · modified 2026-07-07T17:47:48.191916536Z · JSON