Vulnerability · Published Sep 18, 2026 · Assigned by VulDB

CVE-2026-93371marcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injection

High 8.3

In plain English

A high-severity command injection in yt-dlp-web-ui from marcopiovanello. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities).

Severity (CVSS 3.1)8.3High

Exploit odds (30 days)1.4%top 28.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/internal/downloaders/generic.go. Such manipulation of the argument params leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The name of the patch is c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897. A patch should be applied to remediate this issue.

Affected products (as reported)

Vendor	Product	Versions
marcopiovanello	yt-dlp-web-ui	v4

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C

References

VDB-406851 | marcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injection vdb-entry, technical-description
VDB-406851 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-93371 | CVE Analysis and Report third-party-advisory
Submit #942846 | marcopiovanello yt-dlp-web-ui 4 Command Injection third-party-advisory
https://github.com/marcopiovanello/yt-dlp-web-ui/commit/c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897 patch
https://github.com/marcopiovanello/yt-dlp-web-ui/ product