CVE-2026-79792: zackees transcribe-anything Yt-dlp Download ytldp_download.py ytdlp_download os command injection
A flaw has been found in zackees transcribe-anything up to 4.1.0. Affected is the function ytdlpdownload of the file src/transcribeanything/ytldpdownload.py of the component Yt-dlp Download. This manipulation of the argument url causes os command injection. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of zackees transcribe-anything up to version 4.1.0 are affected where an attacker can remotely supply or influence the URL argument passed to the Yt-dlp Download component's ytdlp_download function.
What does an attacker need to exploit it?
The attacker does not need privileges or user interaction, but must be able to manipulate the URL argument. Exploitation is rated high complexity and difficult, although a published exploit is reported.
Is a fix available?
The available information does not identify a fixed version. The project was reportedly notified through an issue report but had not responded at the time of publication.
What can be done if patching is not available?
Restrict untrusted users from supplying or influencing URL values processed by ytdlp_download, and limit remote access to functionality that invokes the Yt-dlp Download component. Treat URL input reaching this function as potentially capable of triggering operating-system command injection.