Transcribe Anything
Monthly
OS command injection in zackees/transcribe-anything (versions up to 4.1.0) allows remote attackers to execute arbitrary system commands by supplying a crafted URL argument to the `ytdlp_download` function in `src/transcribe_anything/ytldp_download.py`. The CVSS 4.0 score is 2.9 - low - primarily because attack complexity is rated High, meaning exploitation requires specific conditions to align rather than trivial one-shot delivery. A publicly available proof-of-concept exploit exists via GitHub issue #137, and the vendor has not responded to the coordinated disclosure, leaving no patch available at time of analysis.
OS command injection in zackees/transcribe-anything (versions up to 4.1.0) allows remote attackers to execute arbitrary system commands by supplying a crafted URL argument to the `ytdlp_download` function in `src/transcribe_anything/ytldp_download.py`. The CVSS 4.0 score is 2.9 - low - primarily because attack complexity is rated High, meaning exploitation requires specific conditions to align rather than trivial one-shot delivery. A publicly available proof-of-concept exploit exists via GitHub issue #137, and the vendor has not responded to the coordinated disclosure, leaving no patch available at time of analysis.