CVE-2026-109966

🗓️ 13 Oct 2026 14:00:17Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 25 Views🌐 WEB

Unauthenticated remote argument injection in yt-dlp-web-ui Service.Formats JSON-RPC method.

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2026-109966	13 Oct 202614:39	–	circl
CNNVD	Marco Piovanello yt-dlp Web UI command injection vulnerability	12 Oct 202616:00	–	cnnvd
Cvelist	CVE-2026-109966 yt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC Method	13 Oct 202614:00	–	cvelist
EUVD	EUVD-2026-98692	13 Oct 202614:00	–	euvd
Mend	CVE-2026-109966	13 Oct 202614:00	–	mend
NVD	CVE-2026-109966	13 Oct 202614:17	–	nvd
Positive Technologies	PT-2026-111587	13 Oct 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-109966: Improper Neutralization of Argument Delimiters in a Command	13 Oct 202600:00	–	rapid7
Vulnrichment	CVE-2026-109966 yt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC Method	13 Oct 202614:00	–	vulnrichment

Vulners

Node

marcopiovanello yt-dlp-web-uiRange≤4.0.0

[
  {
    "vendor": "marcopiovanello",
    "product": "yt-dlp-web-ui",
    "defaultStatus": "unaffected",
    "packageURL": "pkg:golang/github.com/marcopiovanello/yt-dlp-web-ui/v4",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "versionType": "semver",
        "lessThanOrEqual": "4.0.0"
      }
    ]
  }
]

Source	Link
github	www.github.com/marcopiovanello/yt-dlp-web-ui/blob/v4.0.0/server/formats/parser.go
github	www.github.com/vazzzy071-crypto/security-advisories/blob/main/advisories/2026-10-marcopiovanello-yt-dlp-web-ui-rpc-arg-injection.md
vulncheck	www.vulncheck.com/advisories/yt-dlp-web-ui-through-4.0.0-argument-injection-via-service-formats-json-rpc-method
github	www.github.com/marcopiovanello/yt-dlp-web-ui

Parameter	Position	Path	Description	CWE
Service.Formats	request body	/rpc/http	Argument injection via the Service.Formats JSON-RPC method where a dash-prefixed url parameter allows injecting yt-dlp options (e.g., --load-info-json).	CWE-88
Service.Formats	request body	/rpc/ws	Argument injection via the Service.Formats JSON-RPC method where a dash-prefixed url parameter allows injecting yt-dlp options (e.g., --load-info-json).	CWE-88

26 Oct 2026 20:17Current

6Medium risk

Vulners AI Score6

CVSS 3.15.3

CVSS 46.9

EPSS0.00411

SSVC

CWE-88