# CVE-2023-0297: pyload/pyload - RCE

> Live exploitation tracking for CVE-2023-0297 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2023-0297

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** pyload/pyload
- **Weaknesses:** CWE-94 (Improper Control of Generation of Code ('Code Injection'))
- **Tags:** python

## Description

Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.

## CrowdSec analysis

[CVE-2023-0297](https://euvd.enisa.europa.eu/vulnerability/CVE-2023-0297) is a critical code injection vulnerability affecting PyLoad, which may allow attackers to execute arbitrary code by sending crafted requests to the application.

CrowdSec has been tracking this vulnerability and its exploits since 7th of April 2025.

CrowdSec network observations suggest that most exploitation of CVE-2023-0297 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
In addition, according to the CrowdSec network, attack volume against CVE-2023-0297 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers are primarily sending requests to URLs containing `/flash/addcrypted2` in order to exploit this vulnerability.

## Timeline

- 2023-01-14: CVE Published. CVE-2023-0297 is published to NVD.
- 2025-04-07: Rule Released. CrowdSec releases a rule to detect CVE-2023-0297 exploitation attempts against the CrowdSec Network.
- 2025-04-07: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2023-0297 for the first time.

## References

- https://github.com/pyload/pyload/commit/7d73ba7919e594d783b3411d7ddb87885aea782d
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0297.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2023-0297) follows observed exploitation activity for CVE-2023-0297. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.