CVE-2026-79792: OS Command Injection in zackees transcribe-anything

This vulnerability exists in the ytdlp_download function within src/transcribe_anything/ytldp_download.py of zackees transcribe-anything versions 4.0 and 4.1.0. The issue arises from improper handling of the url argument, enabling OS command injection. The attack can be initiated remotely but requires high complexity and is difficult to exploit. The project was notified early but has not issued a fix or official response. No patch or remediation level is currently documented.

Successful exploitation could allow an attacker to execute arbitrary OS commands on the affected system remotely, potentially compromising system integrity and confidentiality. However, the attack complexity is high and exploitability is difficult, which may limit the likelihood of exploitation.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's communications for updates. Until a patch is released, avoid exposing the vulnerable functionality to untrusted inputs or networks if possible.