CVE-2026-93371

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-93371

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93371.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-93371

Published

2026-09-18T02:00:16Z

Modified

2026-09-19T03:47:32Z

Severity

5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P CVSS Calculator

Summary

marcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injection

Details

A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/internal/downloaders/generic.go. Such manipulation of the argument params leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The name of the patch is c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897. A patch should be applied to remediate this issue.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-74",
        "CWE-77"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93371.json"
}

References

Affected packages

Git / github.com/marcopiovanello/yt-dlp-web-ui

Affected ranges

Type

GIT

Repo

https://github.com/marcopiovanello/yt-dlp-web-ui

Events

Introduced

143cc28a97fb8e21c84c9436778fff480e2fa36b

Fixed

c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "v4"
        },
        {
            "last_affected": "v4"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

Other

v4.*

v4.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93371.json"