Dreamdisplays
Monthly
Command-line argument injection into the yt-dlp invocation used by the Dream Displays Minecraft mod/plugin (versions 1.5.0 through 1.8.1) lets player-supplied media/watch-party URLs carry option-like tokens that yt-dlp parses as its own command-line flags, altering the downloader's behaviour. The impact is scored as integrity-only (CVSS 4.0 8.7, and an assessed 3.1 vector of AV:N/AC:L/PR:N/UI:N with C:N/I:H/A:N), and exploitation is confined to servers actually running a vulnerable release with the display/watch-party feature in use; no public exploit code was identified at time of analysis and the issue does not appear in CISA KEV. The vendor fixed the flaw in version 1.8.2 by validating URLs against a media URL policy and inserting an end-of-options marker before passing them to yt-dlp.
Command-line argument injection into the yt-dlp invocation used by the Dream Displays Minecraft mod/plugin (versions 1.5.0 through 1.8.1) lets player-supplied media/watch-party URLs carry option-like tokens that yt-dlp parses as its own command-line flags, altering the downloader's behaviour. The impact is scored as integrity-only (CVSS 4.0 8.7, and an assessed 3.1 vector of AV:N/AC:L/PR:N/UI:N with C:N/I:H/A:N), and exploitation is confined to servers actually running a vulnerable release with the display/watch-party feature in use; no public exploit code was identified at time of analysis and the issue does not appear in CISA KEV. The vendor fixed the flaw in version 1.8.2 by validating URLs against a media URL policy and inserting an end-of-options marker before passing them to yt-dlp.