{"action":"Upgrade pyload-ng to 0.5.0b3.dev78 or later.","affected":[{"fixed":"0.5.0b3.dev78","introduced":"0"}],"component":"pyload-ng","cve_ids":["CVE-2024-22416"],"ecosystem":"PyPI","epss":0.00948,"exploited":false,"fixed_versions":["0.5.0b3.dev78"],"ghsa_id":"GHSA-pgpj-v85q-h5fm","id":"tcs_01M5KGM8GDDED4Y3JP99M4P5HC","modified_at":"2024-01-29T20:41:29.426372Z","published_at":"2024-01-18T00:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2024-17","https://github.com/pyload/pyload/security/advisories/GHSA-pgpj-v85q-h5fm","https://github.com/pyload/pyload/commit/1374c824271cb7e927740664d06d2e577624ca3e","https://github.com/pyload/pyload/commit/c7cdc18ad9134a75222974b39e8b427c4af845fc"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"PYSEC-2024-17","url":"https://osv.dev/vulnerability/PYSEC-2024-17"}],"summary":"pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to `SameSite: strict`,"}