CVE-2026-109966 Details

A vulnerability allowing argument injection has been identified in yt-dlp-web-ui versions through 4.0.0. This issue allows unauthenticated remote attackers to inject yt-dlp options by supplying a dash-prefixed url parameter to the Service.Formats JSON-RPC method. The vulnerability is present in the application's default configuration, which does not require authentication. Exploitation involves sending crafted requests that include injected CLI arguments, which are then executed by the server's yt-dlp command-line interface. This can lead to unauthorized access to local files or internal network resources.

Self-hosted instances should update the application to version 4.0.0 or later, and ensure that authentication is enabled. For versions prior to 4.0.0, it is recommended to manually apply the necessary fixes by validating user input, rejecting leading dashes, and adding authentication requirements.