An unauthenticated remote attacker can supply malicious input via the params parameter to trigger arbitrary command execution on the host server. This flaw poses a high risk to availability, integrity, and confidentiality of the host environment. The vulnerability has been publicly disclosed with functional exploit potential, necessitating immediate remediation. Users must apply the security patch identified by commit c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897 or upgrade to a version where this issue is resolved.

Impact

Successful exploitation of CVE-2026-93371 allows an unauthenticated remote attacker to gain remote code execution (RCE) on the server running yt-dlp-web-ui. This can lead to full system compromise, exfiltration of stored data, or the use of the server as a node in further malicious activities. Given the public availability of exploitation details, the likelihood of automated exploitation attempts targeting internet-facing instances is elevated.

Recommendation

Prioritized actions for security and infrastructure teams:

• Upgrade yt-dlp-web-ui instances to a version containing the fix for CVE-2026-93371.
• Apply the vendor-provided patch c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897 immediately if an upgrade is not feasible.
• Restrict access to the web interface using network-level controls (e.g., VPN or IP whitelisting) until patching is complete.
• Review web server access logs for requests containing suspicious shell metacharacters (e.g., ;, |, &, $, `) directed at endpoints related to the download functionality.