CVE-2026-6218 Details
Description
A vulnerability was found in aandrew-me ytDownloader up to 3.20.2. Affected by this issue is the function createTextNode of the component Error Details Panel. The manipulation results in cross site scripting. The attack may be performed from remote. The vendor was contacted early about this disclosure.
A cross-site scripting (XSS) vulnerability has been identified in Aandrew-me ytDownloader versions up to 3.20.2. This issue arises in the Error Details Panel component, specifically within the createTextNode function. The vulnerability allows for remote code execution by exploiting unsafe handling of untrusted input, which is inserted into the DOM using innerHTML without proper encoding or sanitization. The Electron application, which integrates yt-dlp and ffmpeg for media downloading and processing, has its security settings configured to allow direct access to Node.js and Electron APIs, facilitating the execution of arbitrary commands on the local machine with the user's privileges.
Users are advised to update to a version that addresses this vulnerability. The maintainer has acknowledged the issue and is working on a fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 13, 2026CISA-ADP
Assessed Apr 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ngocnn97/security-advisories/blob/main/YtDownloader_XSS_To_RCE_PoC.mp4 | [email protected] | Exploit |
| https://vuldb.com/submit/785842 | [email protected] | AdvisoryExploitRemedy |
| https://vuldb.com/vuln/357139 | [email protected] | AdvisoryExploitIssue TrackingTechnical Description |
| https://vuldb.com/vuln/357139/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| aandrew-me ytDownloader | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 13, 2026 | New CVE Received | [email protected] |