CVE-2026-109967 in yt-dlp-web-ui
Summary
by MITRE • 10/13/2026
yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an unrecovered panic that terminates the process.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in yt-dlp-web-ui versions up to 4.0.0 represents a critical reliability issue stemming from insufficient input validation within the Service.Formats JSON-RPC method. This component is responsible for processing user-provided URLs to extract metadata and format information using the underlying yt-dlp utility. The flaw arises when an unauthenticated remote attacker submits a specifically crafted request where the url parameter contains invalid or non-URL strings, such as --version. Instead of validating that the input conforms to expected URL structures before passing it to the backend processing logic, the application blindly forwards this malformed data. This lack of sanitization allows malicious inputs to bypass standard checks and reach the core parsing mechanisms, triggering a failure in the JSON output generation process.
From a technical perspective, the root cause is a NULL pointer dereference resulting from an unrecovered panic within the Go runtime environment that powers yt-dlp-web-ui. When the application attempts to parse the invalid response generated by yt-dlp due to the malformed input, it expects valid JSON data structures. However, because the input --version causes yt-dlp to output version information or error messages rather than the expected JSON format, subsequent parsing operations fail. The code does not adequately handle these parsing errors, leading to a situation where the application attempts to access memory addresses that have not been allocated or initialized correctly. This results in an unrecovered panic, which is a severe runtime error in Go applications that causes immediate termination of the process rather than graceful error handling.
The operational impact of this vulnerability is primarily focused on service availability and integrity. Since the attack requires no authentication, any external actor can exploit it by sending a single HTTP request to the affected endpoint. The successful exploitation leads to the crash of the yt-dlp-web-ui server process. This denial-of-service condition disrupts access for all legitimate users attempting to use the video downloading or metadata extraction features hosted on that instance. While this vulnerability does not directly allow for remote code execution, data exfiltration, or privilege escalation in its current form, it effectively renders the service unusable until the administrator manually restarts the application. In environments where high availability is critical, such as public-facing media services, repeated exploitation could lead to significant downtime and operational disruption.
This vulnerability aligns with CWE-476, which describes a NULL Pointer Dereference, indicating that the software performs an operation on a pointer value when it evaluates to null, leading to unexpected termination or crashes. Furthermore, from a threat modeling perspective consistent with MITRE ATT&CK techniques, this behavior is characteristic of T1499 Endpoint Denial of Service, specifically under sub-techniques involving application exhaustion or resource consumption through malformed inputs. The attack vector leverages the network accessibility of the JSON-RPC interface to trigger local system instability without requiring user interaction beyond sending a single packet.
To mitigate this vulnerability, immediate action should be taken by upgrading yt-dlp-web-ui to version 4.0.1 or later, where developers have implemented proper input validation and error handling for the Service.Formats method. Administrators must ensure that all instances are patched against this specific flaw. In addition to software updates, defense-in-depth strategies should be employed. Deploying a Web Application Firewall (WAF) can help filter out obviously malformed requests before they reach the application logic, although reliance on WAFs alone is not recommended as primary protection. Input validation at the API gateway level or within the application code itself, ensuring that URL parameters conform to strict RFC standards and do not contain command-line flags like --version, is essential for preventing similar issues in future versions. Regular security audits focusing on error handling paths are also advised to ensure that other endpoints do not suffer from analogous weaknesses.