CVE-2026-109966: yt-dlp-web-ui RCE Vulnerability

CVE-2026-109966 Overview

CVE-2026-109966 is an argument injection vulnerability in yt-dlp-web-ui through version 4.0.0. The flaw resides in the Service.Formats JSON-RPC method, which accepts a user-supplied url parameter without validating dash-prefixed input. Unauthenticated remote attackers can inject arbitrary yt-dlp command-line options by sending crafted requests to /rpc/http or /rpc/ws. By supplying values such as --load-info-json, attackers force yt-dlp to read attacker-chosen JSON files from the server filesystem, with contents reflected in the response.

Critical Impact

Unauthenticated attackers can read arbitrary JSON-parseable files from the server by injecting yt-dlp arguments through the exposed JSON-RPC endpoints.

Affected Products

• yt-dlp-web-ui by marcopiovanello
• All versions through 4.0.0
• Deployments exposing /rpc/http or /rpc/ws endpoints

Discovery Timeline

• 2026-10-13 - CVE CVE-2026-109966 published to NVD
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109966

Vulnerability Analysis

The vulnerability is classified as Argument Injection under [CWE-88]. The yt-dlp-web-ui project exposes a JSON-RPC interface that forwards user-controlled input to the yt-dlp command-line binary. The Service.Formats method accepts a url parameter intended to identify a media resource. The server fails to validate whether this parameter begins with a dash character.

When a value such as --load-info-json=/etc/passwd.json is supplied, yt-dlp interprets it as a command-line option rather than a URL. This allows attackers to toggle yt-dlp features that read local files, write output, or alter runtime behavior. Response data reflects loaded JSON file contents back to the attacker, enabling information disclosure.

Root Cause

The root cause is improper neutralization of argument delimiters in the parser logic. The url field received over JSON-RPC is passed directly into the argument list constructed for the yt-dlp subprocess. See the parser source at the GitHub Source Code for Parser for the vulnerable implementation.

Attack Vector

Exploitation requires only network reachability to the yt-dlp-web-ui service. No authentication, user interaction, or elevated privileges are needed. An attacker submits a JSON-RPC request to /rpc/http or /rpc/ws invoking Service.Formats with a dash-prefixed url value. yt-dlp executes with the injected option, and the server returns the resulting data to the caller. The technique abuses --load-info-json to read JSON files from the host filesystem accessible to the service account.

Detection Methods for CVE-2026-109966

Indicators of Compromise

• JSON-RPC requests to /rpc/http or /rpc/ws where the url parameter begins with - or --.
• Log entries showing Service.Formats invocations containing yt-dlp option flags such as --load-info-json, --config-location, or --exec.
• Unexpected file read activity by the yt-dlp process targeting paths outside its normal working directory.

Detection Strategies

• Inspect reverse proxy and application logs for JSON-RPC request bodies containing url values that match the regex ^-{1,2}[a-zA-Z].
• Monitor subprocess execution of yt-dlp and alert when command-line arguments include options not expected from the web UI workflow.
• Correlate HTTP 200 responses from /rpc/http with filesystem access telemetry on the host.

Monitoring Recommendations

• Enable verbose application logging on the yt-dlp-web-ui service to capture full JSON-RPC payloads during triage.
• Forward process execution events for yt-dlp to a centralized SIEM for pattern matching.
• Baseline normal url parameter formats and alert on deviations such as leading dashes or embedded = characters.

How to Mitigate CVE-2026-109966

Immediate Actions Required

• Restrict network access to yt-dlp-web-ui using firewall rules or reverse proxy authentication until a patched release is deployed.
• Audit historical logs for prior invocations of Service.Formats containing dash-prefixed url values.
• Run the yt-dlp-web-ui service under a dedicated low-privilege account with read access limited to required directories.

Patch Information

No fixed version is listed in the published NVD record at the time of writing. Monitor the GitHub Repository for yt-dlp-web-ui for a release that supersedes 4.0.0 and consult the VulnCheck Argument Injection Advisory for remediation guidance.

Workarounds

• Place the service behind an authenticating reverse proxy that validates the url JSON-RPC parameter and rejects values beginning with -.
• Deploy a web application firewall rule that drops requests to /rpc/http and /rpc/ws where request bodies contain "url":"-.
• Run the service inside a container or sandbox with a read-only filesystem to limit the impact of file disclosure via --load-info-json.

# Example reverse proxy rule (nginx) to block dash-prefixed url parameters
location ~ ^/rpc/(http|ws)$ {
    if ($request_body ~* "\"url\"\s*:\s*\"-") {
        return 400;
    }
    proxy_pass http://127.0.0.1:3033;
}