Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-109967 (GCVE-0-2026-109967)

Vulnerability from nvd – Published: 2026-10-13 14:00 – Updated: 2026-10-13 14:00 Unsupported When Assigned

Title

yt-dlp-web-ui through 4.0.0 NULL Pointer Dereference DoS via Service.Formats

Summary

yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an unrecovered panic that terminates the process.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-476 - NULL Pointer Dereference

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6057 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/vazzzy071-crypto/security-advi…	third-party-advisoryexploit
https://github.com/marcopiovanello/yt-dlp-web-ui/…	technical-description
https://github.com/marcopiovanello/yt-dlp-web-ui/…	technical-description
https://github.com/marcopiovanello/yt-dlp-web-ui	product
https://www.vulncheck.com/advisories/yt-dlp-web-u…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
marcopiovanello	yt-dlp-web-ui	Affected: 0 , ≤ 4.0.0 (semver)

Date Public

2026-10-13 00:00

Credits

Miraziz Kuchkarov (VOID)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/marcopiovanello/yt-dlp-web-ui/v4",
          "product": "yt-dlp-web-ui",
          "vendor": "marcopiovanello",
          "versions": [
            {
              "lessThanOrEqual": "4.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Miraziz Kuchkarov (VOID)"
        }
      ],
      "datePublic": "2026-10-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an unrecovered panic that terminates the process."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T14:00:18.615Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory",
            "exploit"
          ],
          "url": "https://github.com/vazzzy071-crypto/security-advisories/blob/main/advisories/2026-10-marcopiovanello-yt-dlp-web-ui-rpc-arg-injection.md"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/marcopiovanello/yt-dlp-web-ui/blob/v4.0.0/server/rpc/service.go"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/marcopiovanello/yt-dlp-web-ui/blob/v4.0.0/server/formats/parser.go"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/marcopiovanello/yt-dlp-web-ui"
        },
        {
          "name": "VulnCheck Advisory: yt-dlp-web-ui through 4.0.0 NULL Pointer Dereference DoS via Service.Formats",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/yt-dlp-web-ui-through-4.0.0-null-pointer-dereference-dos-via-service-formats"
        }
      ],
      "tags": [
        "unsupported-when-assigned"
      ],
      "title": "yt-dlp-web-ui through 4.0.0 NULL Pointer Dereference DoS via Service.Formats",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109967",
    "datePublished": "2026-10-13T14:00:18.615Z",
    "dateReserved": "2026-10-13T11:26:13.465Z",
    "dateUpdated": "2026-10-13T14:00:18.615Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109966 (GCVE-0-2026-109966)

Vulnerability from nvd – Published: 2026-10-13 14:00 – Updated: 2026-10-13 14:00 Unsupported When Assigned

Title

yt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC Method

Summary

yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to inject yt-dlp options by supplying a dash-prefixed url parameter to the Service.Formats JSON-RPC method. Attackers can send values like --load-info-json via /rpc/http or /rpc/ws to make yt-dlp load attacker-chosen JSON files from the server filesystem, with contents reflected in responses.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6057 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/vazzzy071-crypto/security-advi…	third-party-advisoryexploit
https://github.com/marcopiovanello/yt-dlp-web-ui/…	technical-description
https://github.com/marcopiovanello/yt-dlp-web-ui	product
https://www.vulncheck.com/advisories/yt-dlp-web-u…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
marcopiovanello	yt-dlp-web-ui	Affected: 0 , ≤ 4.0.0 (semver)

Date Public

2026-10-13 00:00

Credits

Miraziz Kuchkarov (VOID)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/marcopiovanello/yt-dlp-web-ui/v4",
          "product": "yt-dlp-web-ui",
          "vendor": "marcopiovanello",
          "versions": [
            {
              "lessThanOrEqual": "4.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Miraziz Kuchkarov (VOID)"
        }
      ],
      "datePublic": "2026-10-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to inject yt-dlp options by supplying a dash-prefixed url parameter to the Service.Formats JSON-RPC method. Attackers can send values like --load-info-json via /rpc/http or /rpc/ws to make yt-dlp load attacker-chosen JSON files from the server filesystem, with contents reflected in responses."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-88",
              "description": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T14:00:17.990Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory",
            "exploit"
          ],
          "url": "https://github.com/vazzzy071-crypto/security-advisories/blob/main/advisories/2026-10-marcopiovanello-yt-dlp-web-ui-rpc-arg-injection.md"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/marcopiovanello/yt-dlp-web-ui/blob/v4.0.0/server/formats/parser.go"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/marcopiovanello/yt-dlp-web-ui"
        },
        {
          "name": "VulnCheck Advisory: yt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC Method",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/yt-dlp-web-ui-through-4.0.0-argument-injection-via-service-formats-json-rpc-method"
        }
      ],
      "tags": [
        "unsupported-when-assigned"
      ],
      "title": "yt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC Method",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109966",
    "datePublished": "2026-10-13T14:00:17.990Z",
    "dateReserved": "2026-10-13T11:26:13.465Z",
    "dateUpdated": "2026-10-13T14:00:17.990Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-93371 (GCVE-0-2026-93371)

Vulnerability from nvd – Published: 2026-09-18 02:00 – Updated: 2026-09-22 15:44 X_Open Source

Title

marcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injection

Summary

A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/internal/downloaders/generic.go. Such manipulation of the argument params leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The name of the patch is c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897. A patch should be applied to remediate this issue.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C

8.3 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-22 15:05 UTC

CWE

CWE-77 - Command Injection
CWE-74 - Injection

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3875 records in the last 180 days details

References

6 references

URL	Tags
https://vuldb.com/vuln/406851	vdb-entrytechnical-description
https://vuldb.com/vuln/406851/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-93371	third-party-advisory
https://vuldb.com/submit/942846	third-party-advisory
https://github.com/marcopiovanello/yt-dlp-web-ui/…	patch
https://github.com/marcopiovanello/yt-dlp-web-ui/	product

Impacted products

1 product

Vendor	Product	Version
marcopiovanello	yt-dlp-web-ui	Affected: v4 cpe:2.3:a:marcopiovanello:yt-dlp-web-ui::::::::

Credits

HLever (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-93371",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T15:05:07.536417Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:44:33.432Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:marcopiovanello:yt-dlp-web-ui:*:*:*:*:*:*:*:*"
          ],
          "product": "yt-dlp-web-ui",
          "vendor": "marcopiovanello",
          "versions": [
            {
              "status": "affected",
              "version": "v4"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "HLever (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/internal/downloaders/generic.go. Such manipulation of the argument params leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The name of the patch is c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897. A patch should be applied to remediate this issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T02:00:16.308Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-406851 | marcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injection",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/406851"
        },
        {
          "name": "VDB-406851 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/406851/cti"
        },
        {
          "name": "CVE-2026-93371 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-93371"
        },
        {
          "name": "Submit #942846 | marcopiovanello yt-dlp-web-ui 4 Command Injection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/942846"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/marcopiovanello/yt-dlp-web-ui/commit/c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/marcopiovanello/yt-dlp-web-ui/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-17T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-17T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-17T21:33:16.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "marcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injection",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-93371",
    "datePublished": "2026-09-18T02:00:16.308Z",
    "dateReserved": "2026-09-17T19:27:07.761Z",
    "dateUpdated": "2026-09-22T15:44:33.432Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109967 (GCVE-0-2026-109967)

Vulnerability from cvelistv5 – Published: 2026-10-13 14:00 – Updated: 2026-10-13 14:00 Unsupported When Assigned

Title

yt-dlp-web-ui through 4.0.0 NULL Pointer Dereference DoS via Service.Formats

Summary

yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an unrecovered panic that terminates the process.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-476 - NULL Pointer Dereference

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6057 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/vazzzy071-crypto/security-advi…	third-party-advisoryexploit
https://github.com/marcopiovanello/yt-dlp-web-ui/…	technical-description
https://github.com/marcopiovanello/yt-dlp-web-ui/…	technical-description
https://github.com/marcopiovanello/yt-dlp-web-ui	product
https://www.vulncheck.com/advisories/yt-dlp-web-u…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
marcopiovanello	yt-dlp-web-ui	Affected: 0 , ≤ 4.0.0 (semver)

Date Public

2026-10-13 00:00

Credits

Miraziz Kuchkarov (VOID)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/marcopiovanello/yt-dlp-web-ui/v4",
          "product": "yt-dlp-web-ui",
          "vendor": "marcopiovanello",
          "versions": [
            {
              "lessThanOrEqual": "4.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Miraziz Kuchkarov (VOID)"
        }
      ],
      "datePublic": "2026-10-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an unrecovered panic that terminates the process."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T14:00:18.615Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory",
            "exploit"
          ],
          "url": "https://github.com/vazzzy071-crypto/security-advisories/blob/main/advisories/2026-10-marcopiovanello-yt-dlp-web-ui-rpc-arg-injection.md"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/marcopiovanello/yt-dlp-web-ui/blob/v4.0.0/server/rpc/service.go"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/marcopiovanello/yt-dlp-web-ui/blob/v4.0.0/server/formats/parser.go"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/marcopiovanello/yt-dlp-web-ui"
        },
        {
          "name": "VulnCheck Advisory: yt-dlp-web-ui through 4.0.0 NULL Pointer Dereference DoS via Service.Formats",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/yt-dlp-web-ui-through-4.0.0-null-pointer-dereference-dos-via-service-formats"
        }
      ],
      "tags": [
        "unsupported-when-assigned"
      ],
      "title": "yt-dlp-web-ui through 4.0.0 NULL Pointer Dereference DoS via Service.Formats",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109967",
    "datePublished": "2026-10-13T14:00:18.615Z",
    "dateReserved": "2026-10-13T11:26:13.465Z",
    "dateUpdated": "2026-10-13T14:00:18.615Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109966 (GCVE-0-2026-109966)

Vulnerability from cvelistv5 – Published: 2026-10-13 14:00 – Updated: 2026-10-13 14:00 Unsupported When Assigned

Title

yt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC Method

Summary

yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to inject yt-dlp options by supplying a dash-prefixed url parameter to the Service.Formats JSON-RPC method. Attackers can send values like --load-info-json via /rpc/http or /rpc/ws to make yt-dlp load attacker-chosen JSON files from the server filesystem, with contents reflected in responses.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6057 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/vazzzy071-crypto/security-advi…	third-party-advisoryexploit
https://github.com/marcopiovanello/yt-dlp-web-ui/…	technical-description
https://github.com/marcopiovanello/yt-dlp-web-ui	product
https://www.vulncheck.com/advisories/yt-dlp-web-u…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
marcopiovanello	yt-dlp-web-ui	Affected: 0 , ≤ 4.0.0 (semver)

Date Public

2026-10-13 00:00

Credits

Miraziz Kuchkarov (VOID)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/marcopiovanello/yt-dlp-web-ui/v4",
          "product": "yt-dlp-web-ui",
          "vendor": "marcopiovanello",
          "versions": [
            {
              "lessThanOrEqual": "4.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Miraziz Kuchkarov (VOID)"
        }
      ],
      "datePublic": "2026-10-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to inject yt-dlp options by supplying a dash-prefixed url parameter to the Service.Formats JSON-RPC method. Attackers can send values like --load-info-json via /rpc/http or /rpc/ws to make yt-dlp load attacker-chosen JSON files from the server filesystem, with contents reflected in responses."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-88",
              "description": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T14:00:17.990Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory",
            "exploit"
          ],
          "url": "https://github.com/vazzzy071-crypto/security-advisories/blob/main/advisories/2026-10-marcopiovanello-yt-dlp-web-ui-rpc-arg-injection.md"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/marcopiovanello/yt-dlp-web-ui/blob/v4.0.0/server/formats/parser.go"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/marcopiovanello/yt-dlp-web-ui"
        },
        {
          "name": "VulnCheck Advisory: yt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC Method",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/yt-dlp-web-ui-through-4.0.0-argument-injection-via-service-formats-json-rpc-method"
        }
      ],
      "tags": [
        "unsupported-when-assigned"
      ],
      "title": "yt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC Method",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109966",
    "datePublished": "2026-10-13T14:00:17.990Z",
    "dateReserved": "2026-10-13T11:26:13.465Z",
    "dateUpdated": "2026-10-13T14:00:17.990Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-93371 (GCVE-0-2026-93371)

Vulnerability from cvelistv5 – Published: 2026-09-18 02:00 – Updated: 2026-09-22 15:44 X_Open Source

Title

marcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injection

Summary

A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/internal/downloaders/generic.go. Such manipulation of the argument params leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The name of the patch is c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897. A patch should be applied to remediate this issue.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C

8.3 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-22 15:05 UTC

CWE

CWE-77 - Command Injection
CWE-74 - Injection

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3875 records in the last 180 days details

References

6 references

URL	Tags
https://vuldb.com/vuln/406851	vdb-entrytechnical-description
https://vuldb.com/vuln/406851/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-93371	third-party-advisory
https://vuldb.com/submit/942846	third-party-advisory
https://github.com/marcopiovanello/yt-dlp-web-ui/…	patch
https://github.com/marcopiovanello/yt-dlp-web-ui/	product

Impacted products

1 product

Vendor	Product	Version
marcopiovanello	yt-dlp-web-ui	Affected: v4 cpe:2.3:a:marcopiovanello:yt-dlp-web-ui::::::::

Credits

HLever (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-93371",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T15:05:07.536417Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:44:33.432Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:marcopiovanello:yt-dlp-web-ui:*:*:*:*:*:*:*:*"
          ],
          "product": "yt-dlp-web-ui",
          "vendor": "marcopiovanello",
          "versions": [
            {
              "status": "affected",
              "version": "v4"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "HLever (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/internal/downloaders/generic.go. Such manipulation of the argument params leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The name of the patch is c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897. A patch should be applied to remediate this issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T02:00:16.308Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-406851 | marcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injection",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/406851"
        },
        {
          "name": "VDB-406851 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/406851/cti"
        },
        {
          "name": "CVE-2026-93371 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-93371"
        },
        {
          "name": "Submit #942846 | marcopiovanello yt-dlp-web-ui 4 Command Injection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/942846"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/marcopiovanello/yt-dlp-web-ui/commit/c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/marcopiovanello/yt-dlp-web-ui/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-17T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-17T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-17T21:33:16.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "marcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injection",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-93371",
    "datePublished": "2026-09-18T02:00:16.308Z",
    "dateReserved": "2026-09-17T19:27:07.761Z",
    "dateUpdated": "2026-09-22T15:44:33.432Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

6 vulnerabilities found for yt-dlp-web-ui by marcopiovanello

CVE-2026-109967 (GCVE-0-2026-109967)

CVE-2026-109966 (GCVE-0-2026-109966)

CVE-2026-93371 (GCVE-0-2026-93371)

CVE-2026-109967 (GCVE-0-2026-109967)

CVE-2026-109966 (GCVE-0-2026-109966)

CVE-2026-93371 (GCVE-0-2026-93371)