Command Injection in marcopiovanello yt-dlp-web-ui

The application yt-dlp-web-ui, developed by marcopiovanello, contains a critical command injection vulnerability identified as CVE-2026-93371. The flaw resides in the NewGenericDownload function within the source file server/internal/downloaders/generic.go. This vulnerability occurs due to improper sanitization of the params argument before it is passed to underlying system commands.

An unauthenticated remote attacker can supply malicious input via the params parameter to trigger arbitrary command execution on the host server. This flaw poses a high risk to availability, integrity, and confidentiality of the host environment. The vulnerability has been publicly disclosed with functional exploit potential, necessitating immediate remediation. Users must apply the security patch identified by commit c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897 or upgrade to a version where this issue is resolved.

Impact

Successful exploitation of CVE-2026-93371 allows an unauthenticated remote attacker to gain remote code execution (RCE) on the server running yt-dlp-web-ui. This can lead to full system compromise, exfiltration of stored data, or the use of the server as a node in further malicious activities. Given the public availability of exploitation details, the likelihood of automated exploitation attempts targeting internet-facing instances is elevated.

Recommendation

Prioritized actions for security and infrastructure teams:

• Upgrade yt-dlp-web-ui instances to a version containing the fix for CVE-2026-93371.
• Apply the vendor-provided patch c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897 immediately if an upgrade is not feasible.
• Restrict access to the web interface using network-level controls (e.g., VPN or IP whitelisting) until patching is complete.
• Review web server access logs for requests containing suspicious shell metacharacters (e.g., ;, |, &, $, `) directed at endpoints related to the download functionality.