Description
yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an unrecovered panic that terminates the process.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
marcopiovanello yt-dlp-web-ui
Default version status: unaffected
0 to ≤ 4.0.0affected
pkg:golang/github.com/marcopiovanello/yt-dlp-web-ui/v4References
- https://github.com/vazzzy071-crypto/security-advisories/blob/main/advisories/2026-10-marcopiovanello-yt-dlp-web-ui-rpc-arg-injection.md ↗
- https://github.com/marcopiovanello/yt-dlp-web-ui/blob/v4.0.0/server/rpc/service.go ↗
- https://github.com/marcopiovanello/yt-dlp-web-ui/blob/v4.0.0/server/formats/parser.go ↗
- https://github.com/marcopiovanello/yt-dlp-web-ui ↗
- https://www.vulncheck.com/advisories/yt-dlp-web-ui-through-4.0.0-null-pointer-dereference-dos-via-service-formats ↗