CVE-2026-93371: marcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injection
A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/internal/downloaders/generic.go. Such manipulation of the argument params leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The name of the patch is c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897. A patch should be applied to remediate this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
marcopiovanello yt-dlp-web-uito a version that resolves this vulnerability.Patch c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897
Event History
Frequently Asked Questions
Which deployments are affected?
marcopiovanello yt-dlp-web-ui versions up to v4 are affected. The vulnerable code is in NewGenericDownload in server/internal/downloaders/generic.go.
Can this be exploited remotely without authentication or user interaction?
Yes. The supplied vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.
What input is involved in exploitation?
The issue is caused by manipulation of the params argument passed to NewGenericDownload, resulting in command injection.
What should be done to remediate the issue?
Apply the patch identified as c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897. Public exploit disclosure means remediation should be prioritized.