CVE-2026-93371

marcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injection

No known exploitation. EPSS puts it in the 71st percentile. No fix published yet.

CVSS 3.18.3High EPSS percentile71st1.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-09-18Updated 2026-09-22Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Marcopiovanello Yt-dlp-web-uiAffected: v4Upgrade to: not statedStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your business runs yt-dlp-web-ui, including any internet-facing download server, and confirm its installed version.
No confirmed fixed version is available yet; track the project’s security updates and apply the first verified fix when released.
Until then, remove public internet access to the service or restrict it to trusted staff and networks.
Review the server for unexpected processes, new administrator accounts, and unusual download activity.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/internal/downloaders/generic.go. Such manipulation of the argument params leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The name of the patch is c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897. A patch should be applied to remediate this issue.

In plain language

Written by AI from the record

yt-dlp-web-ui up to v4 has a serious flaw that can let an outsider take control of the service, so small businesses using it should act soon.

Unauthenticated remote command injection in yt-dlp-web-ui’s NewGenericDownload function allows attacker-controlled params to reach system command execution.

If you're affected

Server takeover
Download service disruption
Data exposure
Malware installation

What is it

This flaw can let someone send specially crafted instructions to the download service and make its server carry them out. It is like a customer slipping their own instructions into a work order and having the workshop follow them as if they were approved.

Who is affected

This matters to you if you use or run yt-dlp-web-ui, especially on a server that handles downloads for staff or customers. An attacker does not need an account or a person to click anything; it is only a risk if the service is reachable over the network.

How urgent is it

A remote attacker can use this weakness to make the affected server run unwanted instructions, which makes this an amber-priority issue. There is no CISA known-exploited listing and no public exploit code on record, but public-facing installations should be restricted while a verified fix is awaited.

What to do — in detail

Confirm exposure by locating yt-dlp-web-ui deployments, recording their installed versions, and identifying whether the web interface is reachable from untrusted networks. The affected range is reported as up to v4; no vendor-confirmed fixed version or supported branch target is available.

If a verified update is released, test it in a non-production environment before deployment, then upgrade the application and confirm the service starts normally. No breaking-change guidance is available.

If patching is delayed, place the interface behind a VPN, allowlist trusted source addresses, or disable the service until access can be controlled. Review host and application logs for unusual requests, unexpected child processes, changed configuration files, new accounts, and outbound connections. This CVE is not in CISA KEV, so there is no CISA remediation due date.

Technical context

CVE-2026-93371 is rated CVSS 8.3 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L). The reported weakness is CWE-74/CWE-77 command injection in NewGenericDownload in server/internal/downloaders/generic.go, where manipulation of params can lead to remote command execution. CISA KEV does not list the CVE, and the exploit digest reports no public exploit code. EPSS predicts a 1.4% likelihood (70th percentile) with a flat trend; this is predictive, not evidence of active exploitation. The technical description references commit c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897, but the patch finding does not confirm it as an available fix.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS71st

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.4% chance of exploitation activity in the next 30 days, which ranks it in the 71st percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 4 days, from the signal feeds we watch.

2026-09-22Record updated
2026-09-18Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

marcopiovanello
- yt-dlp-web-ui

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Scored 8.3 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality LowSome restricted information is disclosed, but limited in scope
Integrity LowData modification is possible but limited in scope or consequence
Availability LowReduced performance or intermittent disruption of service