yt-dlp-web-ui EUVD-2026-98693

No special configuration is required beyond network reachability of the yt-dlp-web-ui JSON-RPC interface (default Service.Formats method). The attacker needs no authentication, no user interaction, and no prior access (PR:N/UI:N) - a single request with a crafted url value like '--version' is sufficient. The only practical limiting factor is network exposure: the service must be reachable by the attacker (e.g. bound to a routable interface or proxied to the internet rather than restricted to localhost/trusted LAN). Impact is confined to service availability (process crash); there is no data exposure or code execution.

This is a genuine but narrowly-scoped availability risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a trivially-triggerable, remote, unauthenticated, no-interaction attack, and the 8.7 (High) score is driven entirely by VA:H - availability impact only, with VC:N and VI:N confirming no confidentiality or integrity loss. The CWE-476 NULL pointer dereference causing an unrecovered Go panic matches this profile exactly: a single crafted request terminates the process. A public POC exists (reported by VulnCheck), which raises practical exploitability, but the CVE is NOT on the CISA KEV list, so there is no evidence of active in-the-wild exploitation. No EPSS score and no SSVC decision data were provided, so automatability and real-world exploitation probability cannot be independently quantified. Net: the vulnerability is easy to exploit and the impact (full service crash) is real, but it is a denial-of-service only against a niche self-hosted application, so it should be prioritized for patching on exposed instances rather than treated as a critical compromise risk. Note one input inconsistency: the primary advisory reference is titled 'rpc-arg-injection' while the description and CWE-476 characterize this strictly as a NULL pointer dereference DoS - verify there is no additional argument-injection/code-execution dimension with the vendor/VulnCheck advisory.

A remote attacker who can reach the yt-dlp-web-ui JSON-RPC endpoint sends a single Service.Formats request with a url value such as '--version'. This produces invalid yt-dlp JSON output that the server fails to handle, triggering an unrecovered panic that terminates the process and takes the service offline. A public proof-of-concept exists, and because the attack needs no authentication, user interaction, or special conditions (AV:N/AC:L/PR:N/UI:N), it is trivially repeatable to keep the service down.