CVE-2026-109967
HighCVSS 7.5Summary
yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an unrecovered panic that terminates the process.
Risk Assessment
An attacker can remotely crash the server without authentication, causing a denial of service. This may disrupt service availability and impact operations relying on yt-dlp-web-ui.
Recommendation
Update yt-dlp-web-ui to a version later than 4.0.0 if available. Until patching, consider restricting access to the JSON-RPC interface or implementing authentication.
Other vulnerabilities in yt-dlp-web-ui
See all- CVE-2026-109966Medium
yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to inject yt-dlp options by supplying a dash-prefixed url parameter to the Service.Formats JSON-RPC method. Attackers can send values like --load-info-json via /rpc/http or /rpc/ws to make yt-dlp load attacker-chosen JSON files from the server filesystem, with contents reflected in responses.
- CVE-2026-93371High
A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/internal/downloaders/generic.go. Such manipulation of the argument params leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The name of the patch is c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897.
Original NVD description (English source)
yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an unrecovered panic that terminates the process.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS