CVE-2026-93371: yt-dlp-web-ui Command Injection RCE Flaw

CVE-2026-93371 Overview

CVE-2026-93371 is a command injection vulnerability [CWE-74] affecting marcopiovanello yt-dlp-web-ui up to version 4. The flaw resides in the NewGenericDownload function within server/internal/downloaders/generic.go. Attackers can manipulate the params argument to inject arbitrary commands into the underlying download process. The issue is exploitable remotely over the network without authentication or user interaction. Public disclosure of the exploit details has occurred, increasing the risk of opportunistic exploitation. Maintainers have addressed the issue with commit c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897, which introduces a parameter whitelist enforced by argsSanitizer.

Critical Impact

Unauthenticated remote attackers can inject arbitrary command-line arguments into yt-dlp download jobs, potentially leading to command execution in the server context.

Affected Products

• marcopiovanello yt-dlp-web-ui up to and including v4
• Deployments exposing the web UI or API endpoint that invoke NewGenericDownload
• Any downstream containers or forks embedding the vulnerable server/internal/downloaders/generic.go

Discovery Timeline

• 2026-09-18 - CVE-2026-93371 published to NVD
• 2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93371

Vulnerability Analysis

The yt-dlp-web-ui project wraps the yt-dlp command-line tool with a Go-based HTTP server. When a client submits a generic download request, the server constructs a GenericDownloader and forwards user-controlled parameters to the underlying process invocation. Prior to the patch, the Start method called argsSanitizer(g.Params) but assigned the result directly without validating whether sanitization actually succeeded. Attacker-controlled entries in params could therefore reach the command line unchecked. Because the endpoint is network-reachable and unauthenticated in default deployments, an attacker can trigger malicious argument injection over HTTP.

Root Cause

The root cause is insufficient neutralization of special elements passed to a downstream component [CWE-74]. The NewGenericDownload code path treated the sanitizer as advisory rather than authoritative. Without a strict allowlist for permitted yt-dlp arguments, injected flags could redirect output paths, alter execution behavior, or invoke additional commands supported by the downloader.

Attack Vector

An attacker sends a crafted HTTP request to the download endpoint with a malicious params array. Because the vector is network-based and requires no privileges, exploitation can be scripted against exposed instances. The patched code returns an error when parameters fall outside the whitelist, halting the request before process execution.

// Patched Start() in server/internal/downloaders/generic.go
func (g *GenericDownloader) Start() error {
    g.SetPending(true)

-   g.Params = argsSanitizer(g.Params)
+   whiltelistedParams, err := argsSanitizer(g.Params)
+   if err != nil {
+       return err
+   }
+
+   g.Params = whiltelistedParams

    out := internal.DownloadOutput{
        Path:     config.Instance().Paths.DownloadPath,

Source: GitHub Commit c7ad3bd

Detection Methods for CVE-2026-93371

Indicators of Compromise

• HTTP requests to the yt-dlp-web-ui download API containing unexpected yt-dlp flags such as --exec, --postprocessor-args, or shell metacharacters within params.
• New child processes spawned by the yt-dlp-web-ui server that are not yt-dlp itself, including shells (sh, bash) or scripting interpreters.
• Outbound network connections initiated by the download process to hosts unrelated to configured media sources.
• Files written outside the configured Paths.DownloadPath directory, matching the new ErrIsNotSubPath guard introduced in the patch.

Detection Strategies

• Inspect application logs for argsSanitizer errors after patching, which indicate blocked exploitation attempts.
• Monitor process ancestry to flag any non-yt-dlp child of the yt-dlp-web-ui binary.
• Deploy web application firewall rules matching suspicious flag patterns in POST bodies targeting the download endpoint.

Monitoring Recommendations

• Enable audit logging on the host running yt-dlp-web-ui and forward process creation events to a central SIEM.
• Alert on egress traffic from the service account to non-media destinations.
• Track file writes performed by the download process and compare against the configured download path.

How to Mitigate CVE-2026-93371

Immediate Actions Required

• Upgrade yt-dlp-web-ui to a build that includes commit c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897 or later.
• Restrict network exposure of the web UI to trusted networks or place it behind an authenticating reverse proxy.
• Run the service under a dedicated, low-privilege user account with no shell access.
• Review historical logs for anomalous params values that predate the patch.

Patch Information

The fix is delivered in commit c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897 on the marcopiovanello/yt-dlp-web-ui repository. The patch modifies server/internal/downloaders/generic.go so that argsSanitizer returns an error when parameters fall outside the whitelist, and adds a new ErrIsNotSubPath guard in server/internal/downloaders/errors.go to prevent writes outside the configured download directory. Refer to the VulDB advisory for additional context.

// New guard added in server/internal/downloaders/errors.go
package downloaders

var (
    ErrIsNotSubPath = "the provided output path is not valid. It should be under the configured download path."
)

Source: GitHub Commit c7ad3bd

Workarounds

• Place the web UI behind a reverse proxy that enforces authentication and rate limiting until the patch is applied.
• Filter requests to the download endpoint at the proxy layer, rejecting params entries containing --exec, backticks, semicolons, or $(.
• Run the service inside a container with a read-only filesystem, restricted egress, and no shell binaries available.

# Example reverse proxy filter (nginx) blocking dangerous flags in request bodies
location /api/download {
    if ($request_body ~* "(--exec|--postprocessor-args|;|\$\(|`)") {
        return 403;
    }
    proxy_pass http://127.0.0.1:3033;
}