Threats affecting pkg:brew/tubeup

A buffer overflow vulnerability exists in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0. This flaw allows remote unauthenticated attackers to corrupt adjacent decoder state memory, potentially leading to sensitive memory disclosure, denial of service, or arbitrary code execution. Users should update affected Brotli libraries or binaries to fixed versions 1.0.10, 1.1.1, or 1.2.1 to mitigate this issue.

yt-dlp versions before 2026.5.8_1 have a vulnerability in the handling of the --write-link, --write-url-link, and --write-desktop-link options. Improper sanitization of metadata used in shortcut files (.url on Windows and .desktop on Linux) can lead to command injection. On Windows, a crafted file:// URI in the webpage_url can cause execution of remote executables when the .url file is opened. On Linux, disabling filename sanitization with --no-windows-filenames allows injection of arbitrary shell commands in .desktop files. This can lead to remote code execution if the user opens the crafted shortcut files.