rootpwn

high · CVSS v3 8.3 · CVSS v4 6.9

CVE-2026-93371

A command injection vulnerability exists in the NewGenericDownload function within server/internal/downloaders/generic.go of marcopiovanello

Overview

A command injection vulnerability exists in the NewGenericDownload function within server/internal/downloaders/generic.go of marcopiovanello yt-dlp-web-ui up to v4. Remote attackers can exploit improper parameter handling to execute arbitrary commands on the underlying system. This poses a significant risk to confidentiality, integrity, and availability as public exploit details are available.

Description

A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/internal/downloaders/generic.go. Such manipulation of the argument params leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The name of the patch is c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897. A patch should be applied to remediate this issue.

Impact

Successful exploitation allows remote attackers to achieve arbitrary command execution with the privileges of the application. This directly impacts system integrity and confidentiality, potentially leading to full host compromise. Organizations running vulnerable instances are at high risk due to publicly available exploit methods.

Remediation

Apply the official patch identified by commit hash c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897 immediately. Upgrade yt-dlp-web-ui to a version later than v4 where input sanitization for download parameters is implemented. Restrict network access to the web interface using firewalls or VPNs until patching is complete.

Risk context

The vulnerability carries a high CVSS v3 score of 8.3, indicating severe potential impact if left unpatched. Public disclosure of exploitation techniques increases the operational urgency for defenders to apply mitigations.

Affected products

  • marcopiovanello yt-dlp-web-ui <= v4

Scores

Severity
high
CVSS v2
7.5
CVSS v3
8.3
CVSS v4
6.9
EPSS
—

command-injection remote-code-execution input-validation yt-dlp-web-ui high-severity

← All CVEs

Related CVEs

high

CVE-2026-93455

django-page-cms through version 2.0.13 contains an authorization bypass vulnerability in its admin helper views. The flaw allows low-privilege staff accounts to read unpublished drafts, page listings, and stored media paths without proper permission validation. This matters because it exposes sensitive organizational content to internal users who should not have access.

View analysis

high

CVE-2026-52727

The lxc-ci project inadvertently included a static pacman local-signing private key within Arch Linux container and virtual machine images built prior to May 28, 2026. This allows a malicious or compromised package mirror to issue cryptographically trusted packages to clients. Consequently, attackers can achieve arbitrary code execution as root on affected systems.

View analysis

high

CVE-2026-77169

A authorization bypass vulnerability exists in the team folders app when used alongside the workspace app. This flaw allows API-only delegated administrators to circumvent folder-level access restrictions. It matters because it undermines multi-tenant isolation and administrative privilege boundaries.

View analysis

high

CVE-2026-93313

An integer overflow vulnerability exists in Freedesktop Poppler version 26.07.0 within the JBIG2Stream::readCodeTableSeg function in poppler/JBIG2Stream.cc. This flaw can be triggered remotely via malicious PDF files containing crafted JBIG2 streams. It matters because successful exploitation could lead to application crashes or potentially arbitrary code execution in environments processing untrusted documents.

View analysis