The vulnerability occurs when a link URL stored by a user is interpolated into a template literal that is then wrapped in single‑quoted HTML and written to the DOM with $(div).html(html). Because no escaping is performed, an attacker who can submit a package link can insert a single quote followed by an event handler or arbitrary script, breaking out of the attribute context and executing code in the browser each time the Downloads view is loaded.

Installing pyLoad before version 0.5.0b3.dev100 and using the modern theme exposes this flaw. Any installation that allows users to submit package links will store URLs that can be later rendered in the Downloads view, making the vulnerability applicable to all systems running the affected code base.

The CVSS score of 8.7 classifies this as a high‑severity flaw. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to submit a malicious package link; once the link is stored, all users who open the Downloads view will receive arbitrary JavaScript execution in their browser context, potentially granting an attacker full control of the client environment.