CVE-2026-109967 Details
Description
yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an unrecovered panic that terminates the process.
A NULL pointer dereference vulnerability has been identified in yt-dlp-web-ui versions through 4.0.0. This vulnerability exists within the Service.Formats JSON-RPC method, where remote unauthenticated attackers can send a request that includes a URL value such as '--version'. This request leads to invalid JSON output from yt-dlp, causing an unhandled panic that crashes the server. The issue arises because the Service.Formats method does not properly validate or sanitize the URL input before it is processed, allowing for the injection of harmful command-line arguments that can disrupt the application's normal operation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| marcopiovanello yt-dlp-web-ui | <= 4.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |