Dream Displays EUVD-2026-114466

Requires a Minecraft server running Dream Displays 1.5.0 through 1.8.1 where a player can supply a media/watch-party URL that reaches the yt-dlp invocation; the attacker embeds option-like tokens in that URL so yt-dlp parses them as arguments. The fix confirms the mechanism: it rejects URLs containing whitespace or control characters, restricts input to a bare 11-char YouTube id or an http(s) URL via MediaUrlPolicy, and inserts a '--' end-of-options marker before the URL. LIMITING FACTORS: exploitation is scoped to servers actually running a vulnerable version with the display/watch-party feature in use, and impact is confined to yt-dlp's behavior (integrity) with no confidentiality or availability impact per the vendor vector. The description's 'under specific conditions' qualifier is not elaborated, so whether every input path is exploitable is not described in the available sources.

Signals are mixed and point to a real-but-contained issue rather than a mass-exploitation emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with VI:H and VC:N/VA:N describes a network-reachable, low-complexity argument-injection flaw (CWE-88) whose only impact is to integrity - the ability to alter yt-dlp's behavior - not confidentiality or availability, which tempers the 8.7 base score. The vuln.today priority is 'this_week', not act_now/emergency. There is no CISA KEV listing and no EPSS score in the input, so there is no public signal of active or probable exploitation; status is no public exploit identified at time of analysis. The description's qualifier 'under specific conditions' conflicts with the clean AC:L/AT:N rating - the exact trigger conditions are not described in the available sources, so the practical ease of exploitation is less certain than the vector implies. Note also a vendor-identity discrepancy: the CPE names vendor 'arsmotorin' while all references and the fix live under github.com/arnodoelinger - verify the canonical maintainer. Net: a legitimate integrity flaw worth patching on a normal cycle, bounded by a niche deployment footprint, not a high-CVSS issue masquerading as urgent, but also not a mass-exploited priority.

On a multiplayer Minecraft server running Dream Displays 1.5.0-1.8.1, a player submits a crafted media or watch-party URL containing option-like tokens; because the invocation lacked a '--' end-of-options separator, yt-dlp interprets the injected tokens as command-line options and alters its behavior. The exact conditions required are not described in the available sources, and no public exploit was identified at time of analysis.