Description

A flaw has been found in zackees transcribe-anything up to 4.1.0. Affected is the function ytdlp_download of the file src/transcribe_anything/ytldp_download.py of the component Yt-dlp Download. This manipulation of the argument url causes os command injection. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.6",
  "pubDate": "2026-08-25T21:18:23.660Z",
  "pubdate": "2026-08-25T21:18:23.660Z",
  "executiveSummary": "A critical OS command injection vulnerability exists in the transcribe-anything package up to version 4.1.0, specifically within the Yt-dlp Download component.\nThe vulnerability originates from improper sanitization of the 'url' argument passed to the 'ytdlp_download' function in 'src/transcribe_anything/ytldp_download.py'.\nThis flaw allows a remote attacker to execute arbitrary system commands on the underlying host operating system by injecting malicious payloads into the URL parameter.\nThe impact includes full compromise of the application environment, potentially leading to unauthorized data access, system modification, or service disruption.\nWhile the attack complexity is classified as high and the exploitability as difficult, a public exploit exists, increasing the risk for environments where user-supplied URLs are processed without rigorous validation.\nThe project maintainers have been notified via issue report but have not yet provided a patch or formal response.",
  "technicalDetails": "The vulnerability resides in the 'ytdlp_download' function located in 'src/transcribe_anything/ytldp_download.py'.\nThe root cause is the insecure handling of the 'url' argument when invoking the underlying yt-dlp command-line utility. The application constructs system calls by concatenating user-supplied input directly into shell execution contexts without sufficient escaping or input validation.\nAn attacker can exploit this by crafting a URL string that includes shell metacharacters—such as semicolons, pipes, or command substitution operators (e.g., $(command) or `command`)—to break out of the intended yt-dlp command structure.\nWhen the 'ytdlp_download' function executes, the shell interprets these metacharacters, executing the injected commands with the privileges of the process running the transcribe-anything application.\nThe attack flow proceeds as follows: 1. The attacker identifies an input vector that passes a string to the 'ytdlp_download' function. 2. The attacker crafts a malicious URL payload containing shell injection primitives. 3. The application accepts this input and passes it to an unsanitized system call. 4. The operating system parses the shell commands embedded within the URL. 5. The injected payload executes, allowing the attacker to run arbitrary code on the host system.\nThe vulnerability is remotely exploitable, meaning an attacker does not require local access to the server. No authentication is required if the entry point to the affected function is exposed via an public-facing interface.\nThe post-exploitation impact is severe, as the attacker gains the execution context of the application, which may allow for persistence, lateral movement within the network, or exfiltration of sensitive files.\nGiven that the exploit code is publicly available, the barrier to entry for potential attackers is significantly lowered despite the initial high-complexity rating."
}