Executive brief
ytDownloader, a tool used for downloading videos, contains a security vulnerability in its Error Details Panel. An attacker could potentially execute malicious scripts in a user's browser if they are tricked into viewing a specially crafted error message. This could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive session information.
Technical details
A cross-site scripting (XSS) vulnerability exists in aandrew-me ytDownloader versions up to 3.20.2. The flaw is located in the 'createTextNode' function within the 'Error Details Panel' component. A remote attacker can exploit this by providing malicious input that is improperly neutralized before being rendered in the application's UI. Successful exploitation requires user interaction (viewing the error panel) and can lead to the execution of arbitrary JavaScript. While primarily identified as XSS, some references suggest potential escalation to Remote Code Execution (RCE) depending on the application's execution environment.
Affected products
- aandrew-me ytDownloader up to 3.20.2
Timeline
- 2026-04-13: disclosed: Initial disclosure via VulDB and NVD
- 2026-04-13: advisory