CVE-2026-93371
marcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injection
CVSS Score
8.3
EPSS Score
0.0%
EPSS Percentile
0th
A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/internal/downloaders/generic.go. Such manipulation of the argument params leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The name of the patch is c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897. A patch should be applied to remediate this issue.
| CWE | CWE-77 CWE-74 |
| Vendor | marcopiovanello |
| Product | yt-dlp-web-ui |
| Published | Sep 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for marcopiovanello yt-dlp-web-ui
Be the first to know when new high vulnerabilities affecting marcopiovanello yt-dlp-web-ui are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
marcopiovanello / yt-dlp-web-ui
v4
References
vuldb.com: https://vuldb.com/vuln/406851 vuldb.com: https://vuldb.com/vuln/406851/cti vuldb.com: https://vuldb.com/cve/CVE-2026-93371 vuldb.com: https://vuldb.com/submit/942846 github.com: https://github.com/marcopiovanello/yt-dlp-web-ui/commit/c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897 github.com: https://github.com/marcopiovanello/yt-dlp-web-ui/
Credits
🔍 HLever (VulDB User)