EUVD-2026-82640
GHSA-vppc-qfgr-6vg2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed yt-dlp-web-ui endpoint
-
DeliverySubmit download with malicious params flags
-
ExploitUnsanitized args injected into yt-dlp command
-
Executionyt-dlp executes attacker option (e.g. --exec)
-
ImpactArbitrary command runs as service user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires reachability of the yt-dlp-web-ui download/generic-download feature (the NewGenericDownload code path) and the ability to control the params argument passed to a download job. Per CVSS PR:N/UI:N the attack is remote with no user interaction, but exploitation is limited to instances that are network-exposed AND either run without the app's optional authentication secret or where the attacker already holds a valid session; deployments behind authentication or not exposed to untrusted networks are substantially harder to exploit. Affected: marcopiovanello yt-dlp-web-ui up to v4; fixed by commit c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897 which enforces a flag allowlist. |
| Impact | This is a genuinely serious flaw whose vendor score understates it. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated attack, and the exploit-maturity metric E:P plus the description ('The exploit has been disclosed publicly and may be used') confirm publicly available exploit code exists - no KEV listing and no EPSS score are provided. The vendor rated all impacts Low (VC:L/VI:L/VA:L, SC:L/SI:L/SA:L → base 6.9), but the source diff shows why that is optimistic: pre-patch, argsSanitizer was a no-op that returned attacker-supplied params verbatim into the yt-dlp command line, and the fix introduces a strict flag allowlist. Because yt-dlp itself exposes dangerous options such as --exec, --downloader, --postprocessor-args and --paths (all now blocked by the new allowlist), unfiltered argument injection realistically escalates to arbitrary OS command execution as the service user, which is closer to C:H/I:H/A:H than to the Low ratings assigned. Net: treat this as a high real-world priority for anyone exposing yt-dlp-web-ui - public exploit + network vector + likely RCE. The main mitigating uncertainty is authentication: VulDB set PR:N, but yt-dlp-web-ui supports a configurable auth secret, so instances behind authentication or not internet-exposed are materially lower risk - verify your deployment's auth configuration. |
| Exploit ScenarioDerived | An attacker who can reach the yt-dlp-web-ui download endpoint submits a download request whose params array contains extra yt-dlp flags (e.g. --exec) that the pre-patch argsSanitizer passed through unchanged. When the download job runs, yt-dlp executes the injected option, running an arbitrary OS command on the host. A public exploit for this argument-injection path has been disclosed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Remote command injection in marcopiovanello yt-dlp-web-ui up to v4 lets a remote attacker (CVSS 4.0 vector records PR:N/UI:N, i.e. unauthenticated and no user interaction) abuse the params argument processed by NewGenericDownload in server/internal/downloaders/generic.go to inject arbitrary yt-dlp flags and shell metacharacters into the spawned download command. Publicly available exploit code exists - the flaw was publicly disclosed alongside the CVE, so any network-reachable instance of the generic download feature is a realistic target; there is no indication of confirmed active exploitation (not in CISA KEV). An upstream fix commit (c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897) replaces the previous weak sanitizer with a strict allowlist of yt-dlp flags, but no tagged patched release version is confirmed in the available data, so operators must either track the commit or restrict exposure.
RemediationAI
Apply the upstream fix commit c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897 (https://github.com/marcopiovanello/yt-dlp-web-ui/commit/c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897), which replaces the ineffective argsSanitizer with an allowlist of permitted yt-dlp flags and rejects everything else, along with output-path validation - note that because the fix is delivered as a commit, no tagged fixed release version is confirmed in the available data, so verify whether your deployment builds from a release artifact or from source before claiming patched status. Until the commit is deployed, the most effective compensating controls are: enable the application's optional authentication secret so that the PR:N assumption no longer holds and a valid session is required; and/or avoid exposing the web UI to untrusted networks at all - place it on a loopback/management-only interface or behind a reverse proxy that enforces authentication and restricts source IPs, since the generic download feature is the entire attack surface here. If the generic download capability is not needed, removing or blocking the corresponding endpoint/route eliminates the exposure entirely, at the cost of losing generic (non-site-specific) URL downloads. Blocking only the UI is a partial measure because the underlying command execution still occurs server-side whenever the feature is reachable by any authenticated or unauthenticated caller; restoring any of these controls without the allowlist patch leaves the injection primitive intact.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
yt-dlp-web-ui is a Go-based web front end that wraps the yt-dlp media downloader: user-supplied job parameters are assembled into a yt-dlp argument vector and executed by the server process. The vulnerable code path is NewGenericDownload() in server/internal/downloaders/generic.go, which stored attacker-controllable params into the GenericDownloader and handed them to the child process command. The commit diff shows the pre-fix argsSanitizer() in utils.go returned the caller's slice essentially unchanged, so any flag (or injected shell metacharacter embedded in a value) survived sanitization and reached the command invocation - the classic root cause of CWE-77 (Improper Neutralization of Special Elements used in a Command). The fix adds an allowedFlags map enumerating permitted yt-dlp options (format selection, playlist/filtering, download behaviour, subtitles, thumbnails, post-processing, sponsorblock, verbosity) and makes argsSanitizer return an error for any flag not on the list, with NewGenericDownload propagating that error instead of proceeding; the same commit also introduces ErrIsNotSubPath for validating output paths against the configured download directory. CPE data (cpe:2.3:a:marcopiovanello:yt-dlp-web-ui:*:*:*:*:*:*:*:*) confirms a wildcarded version range with no upper bound recorded, matching EUVD's statement that all releases up to and including v4 are affected.
Know when Yt Dlp Web Ui gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P
Unsanitized args reach yt-dlp allowing --exec-style OS command execution (C/I/A:H); network, low-complexity, no interaction; PR:N per vendor vector though auth is config-dependent.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/internal/downloaders/generic.go. Such manipulation of the argument params leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The name of the patch is c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897. A patch should be applied to remediate this issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
More in Yt Dlp Web Ui
View allUnauthenticated remote attackers can crash yt-dlp-web-ui 4.0.0 and earlier by sending a single JSON-RPC request to the d
Unauthenticated information disclosure in yt-dlp-web-ui through 4.0.0 lets remote attackers read server-side files by su
Exploit-DB