Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-109966

yt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC Method

yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to inject yt-dlp options by supplying a dash-prefixed url parameter to the Service.Formats JSON-RPC method. Attackers can send values like --load-info-json via /rpc/http or /rpc/ws to make yt-dlp load attacker-chosen JSON files from the server filesystem, with contents reflected in responses.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Marcopiovanello
Products
Yt-dlp-web-ui
CVE-2026-109967

yt-dlp-web-ui through 4.0.0 NULL Pointer Dereference DoS via Service.Formats

yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an unrecovered panic that terminates the process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Marcopiovanello
Products
Yt-dlp-web-ui
CVE-2026-93371

marcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injection

A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/internal/downloaders/generic.go. Such manipulation of the argument params leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The name of the patch is c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897. A patch should be applied to remediate this issue.

CVSS 4.0 · 6.9 Medium EPSS 1.4% KEV · Not listed
Vendors
Marcopiovanello
Products
Yt-dlp-web-ui