Threats affecting pkg:github/marcopiovanello/yt-dlp-web-ui

yt-dlp-web-ui versions up to 4.0.0 contain a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method. This flaw allows remote unauthenticated attackers to crash the server by sending a specially crafted request with a url value such as --version, which triggers invalid JSON output and an unrecovered panic that terminates the process.

yt-dlp-web-ui versions up to 4.0.0 have an argument injection vulnerability that allows unauthenticated remote attackers to inject command-line options by supplying specially crafted dash-prefixed URL parameters to the Service.Formats JSON-RPC method. This can cause the application to load attacker-controlled JSON files from the server filesystem, which are then reflected in responses. The vulnerability is fixed in version 4.0.1.

A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/internal/downloaders/generic.go. Such manipulation of the argument params leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The name of the patch is c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897. A patch should be applied to remediate this issue.