CVE-2026-109966
yt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC Method
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to inject yt-dlp options by supplying a dash-prefixed url parameter to the Service.Formats JSON-RPC method. Attackers can send values like --load-info-json via /rpc/http or /rpc/ws to make yt-dlp load attacker-chosen JSON files from the server filesystem, with contents reflected in responses.
| CWE | CWE-88 |
| Vendor | marcopiovanello |
| Product | yt-dlp-web-ui |
| Published | Oct 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for marcopiovanello yt-dlp-web-ui
Be the first to know when new medium vulnerabilities affecting marcopiovanello yt-dlp-web-ui are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
marcopiovanello / yt-dlp-web-ui
0 ≤ 4.0.0
References
github.com: https://github.com/vazzzy071-crypto/security-advisories/blob/main/advisories/2026-10-marcopiovanello-yt-dlp-web-ui-rpc-arg-injection.md github.com: https://github.com/marcopiovanello/yt-dlp-web-ui/blob/v4.0.0/server/formats/parser.go github.com: https://github.com/marcopiovanello/yt-dlp-web-ui vulncheck.com: https://www.vulncheck.com/advisories/yt-dlp-web-ui-through-4.0.0-argument-injection-via-service-formats-json-rpc-method
Credits
Miraziz Kuchkarov (VOID)