A vulnerability in MeTube’s Feed‑metadata Thumbnail Fetch Handler allows an attacker to trigger a server‑side request forgery (SSRF) via the DownloadQueue.__write_feed_metadata_sync function. The flaw can be abused by supplying crafted input that causes the server to fetch arbitrary URLs, exposing internal resources, leaking sensitive data, or enabling further network‑level attacks. The description labels the exploit as highly complex and difficult, indicating that while the flaw exists, the attacker must craft a precise payload.

All releases of MeTube prior to 2026.09.29 are affected. The affected component is the Feed‑metadata Thumbnail Fetch module in the app/ytdl.py file of alexta69’s MeTube. The remedial patch a3896604540223ecbb8258b41b1d745d62647d16 was included in the 2026.09.29 release.

The CVSS score of 6.3 classifies the issue as medium severity. No EPSS score is publicly available, and the vulnerability is not listed in CISA’s KEV catalog. The advisory indicates that exploitation is possible but non‑trivial, and the publicly disclosed exploit can be used against remote servers still running vulnerable versions. Prompt upgrading is recommended to eliminate the risk.