CVE-2026-109966
Received Received - Intake

yt-dlp-web-ui Argument Injection via yt-dlp Options

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to inject yt-dlp options by supplying a dash-prefixed url parameter to the Service.Formats JSON-RPC method. Attackers can send values like --load-info-json via /rpc/http or /rpc/ws to make yt-dlp load attacker-chosen JSON files from the server filesystem, with contents reflected in responses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109966
EUVD
EUVD-2026-98692

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
marcopiovanello yt-dlp-web-ui 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

yt-dlp-web-ui through version 4.0.0 has an argument injection vulnerability (CVE-2026-109966) allowing unauthenticated remote attackers to inject yt-dlp options via dash-prefixed URL parameters in the Service.Formats JSON-RPC method. Attackers can use endpoints like /rpc/http or /rpc/ws to send values such as --load-info-json, forcing yt-dlp to load attacker-chosen JSON files from the server filesystem. The contents of these files are reflected in responses, enabling unauthorized access or further exploitation.

Detection Guidance

Check for unusual requests to /rpc/http or /rpc/ws endpoints with dash-prefixed URL parameters. Monitor logs for JSON-RPC calls containing --load-info-json or similar CLI options. Inspect network traffic for malformed URLs starting with hyphens targeting these endpoints.

Impact Analysis

This vulnerability can allow attackers to read arbitrary files on the server filesystem, perform server-side request forgery (SSRF) attacks against internal resources, or crash the server via a denial-of-service by triggering a nil pointer dereference. Unauthorized file access may expose sensitive data, while SSRF could enable further network reconnaissance or attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles (e.g., integrity and confidentiality) and HIPAA's security requirements for protected health information. Organizations using affected versions may face compliance breaches, legal penalties, and reputational damage due to potential data exposure.

Mitigation Strategies

Disable unauthenticated access to /rpc/http and /rpc/ws endpoints. Block URLs starting with hyphens at the network perimeter. Update yt-dlp-web-ui if a patch becomes available. Consider migrating to an alternative solution as the project is archived.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109966. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart