Youtube Downloader
Monthly
Server-side request forgery in athlon1600 youtube-downloader up to 4.0.1 lets remote, unauthenticated attackers make the server issue attacker-controlled HTTP/HTTPS requests by manipulating the url argument of public/stream.php. Publicly available exploit code exists (per VulDB and the linked exploit gist), but there is no CISA KEV confirmation of active exploitation, and assessed impact is limited to low confidentiality and integrity effects against internal services and cloud metadata endpoints reachable from the host. The vendor was contacted early and never responded, and the only code change tied to this component (commit 6ffe823, 'better security for public/stream.php') is a partial hardening rather than a fix.
Server-side request forgery in athlon1600 youtube-downloader up to 4.0.1 lets remote, unauthenticated attackers make the server issue attacker-controlled HTTP/HTTPS requests by manipulating the url argument of public/stream.php. Publicly available exploit code exists (per VulDB and the linked exploit gist), but there is no CISA KEV confirmation of active exploitation, and assessed impact is limited to low confidentiality and integrity effects against internal services and cloud metadata endpoints reachable from the host. The vendor was contacted early and never responded, and the only code change tied to this component (commit 6ffe823, 'better security for public/stream.php') is a partial hardening rather than a fix.