MeTube vulnerabilities

A vulnerability was detected in alexta69 MeTube in the DownloadQueue.__write_feed_metadata_sync function of app/ytdl.py, related to feed-metadata thumbnail fetching. Manipulation leads to server-side request forgery, and the attack may be launched remotely though it is highly complex. The issue is fixed in version 2026.09.29 (commit a3896604540223ecbb8258b41b1d745d62647d16).

A vulnerability was found in alexta69 MeTube up to 2026.06.10. An unknown function in the file /download/.metube/cookies.txt of the Cookie File Handler component allows files or directories to be accessible. The attack can be initiated remotely, and the exploit has been publicly disclosed. Upgrading to version 2026.06.20 resolves the issue.

alexta69 MeTube up to 2026.04.09 contains a vulnerability in the on_prepare function in app/main.py related to CORS policy. The manipulation leads to a permissive cross-domain policy with untrusted domains. The exploit has been publicly disclosed and fixed in version 2026.04.10.