A critical OS command injection vulnerability in pyLoad allows authenticated users to achieve remote code execution by manipulating the AntiVirus plugin configuration.

The application fails to properly restrict configuration options within the AntiVirus plugin. An attacker with standard user privileges and SETTINGS permissions can modify the executable path parameter, which is then passed directly to a system command execution function, resulting in OS command injection.

Successful exploitation allows an authenticated attacker to execute arbitrary code on the underlying host system with the privileges of the pyLoad process. This can lead to full system compromise, unauthorized access to sensitive download data, or lateral movement within the network. Given the CVSS score of 8.8, this vulnerability poses a high risk to the confidentiality, integrity, and availability of the affected environment.

Immediate Action: As no formal patch version is currently available, restrict access to the SETTINGS functionality to only the most trusted administrative accounts. Review the GitHub advisory for available commit-level patches and apply them if possible.

Proactive Monitoring: Monitor system logs for suspicious subprocess execution patterns, specifically processes spawned by the pyLoad user that deviate from standard AntiVirus utility paths.

Compensating Controls: Implement strict network segmentation for the server hosting pyLoad and ensure the application process runs with the least privilege necessary to limit the impact of a potential command injection.

Public Exploit Available: Unknown.

Organizations currently running pyLoad versions 0.5.0b3.dev96 and earlier must prioritize this vulnerability. Since a public proof-of-concept exists and the vulnerability leads to remote code execution, it is imperative to limit access to settings immediately and monitor for unauthorized configuration changes while awaiting an official software update.