ghsa:GHSA-P3PR-8F3M-4QP8: pyload-ng <= 0.5.0b3.dev101

Affected technology

pyload-ng · <= 0.5.0b3.dev101
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

The attacker can therefore direct blind POST requests at internal hosts such as loopback services, RFC 1918 addresses, or the cloud metadata endpoint `169.254.169.254`. ## Root Cause pyLoad enforces its outbound SSRF protection only inside the pycurl request path, where a `PREREQFUNCTION` callback calls `is_global_address()` on the resolved peer IP before each connection. Source advisory’s CVSS 3.1 assessment rates confidentiality and integrity impact as low; availability impact as none.