Description
A flaw has been found in zackees transcribe-anything up to 4.1.0. Affected is the function ytdlp_download of the file src/transcribe_anything/ytldp_download.py of the component Yt-dlp Download. This manipulation of the argument url causes os command injection. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-08-25
Score: 6.3 Medium
EPSS: 1.1% Low
KEV: No
Impact: Command Injection
Action: Patch
AI Analysis

Impact

The vulnerability is an OS command injection in the ytdlp_download function of the Yt-dlp Download component. By modifying the URL argument, an attacker can inject arbitrary shell commands. The flaw is present in all releases up to version 4.1.0 and can be exploited remotely, with a high complexity rating. Exploits have been published, increasing the risk that an attacker may use them to gain unauthorized execution on the host.

Affected Systems

Affected are installations of the zackees transcribe‑anything package in versions 4.1.0 and earlier. The error occurs in the file src/transcribe_anything/ytldp_download.py within the Yt‑dlp Download component; no other vendors or products are listed as impacted.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity. The EPSS score is 1%, and the vulnerability is not listed in the CISA KEV catalog. Remote exploitation is possible if the application processes untrusted URLs, and the high complexity and published exploits suggest that the risk to systems is non‑negligible, especially when the process runs with privileged permissions.

Generated by OpenCVE AI on August 26, 2026 at 14:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update to the latest version of zackees transcribe‑anything that fixes the command injection bug (any release newer than 4.1.0).
  • If an upgrade is not immediately possible, modify the ytdlp_download implementation to validate or escape the URL argument before it is passed to the shell.
  • Run the download process under the least privilege account, limiting its ability to execute system commands.

Generated by OpenCVE AI on August 26, 2026 at 14:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 26 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 25 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Description A flaw has been found in zackees transcribe-anything up to 4.1.0. Affected is the function ytdlp_download of the file src/transcribe_anything/ytldp_download.py of the component Yt-dlp Download. This manipulation of the argument url causes os command injection. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title zackees transcribe-anything Yt-dlp Download ytldp_download.py ytdlp_download os command injection
First Time appeared Zackees
Zackees transcribe-anything
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:zackees:transcribe-anything:*:*:*:*:*:*:*:*
Vendors & Products Zackees
Zackees transcribe-anything
References
Metrics cvssV2_0

{'score': 5.1, 'vector': 'AV:N/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.6, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Zackees Transcribe-anything
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-26T14:11:58.280Z

Reserved: 2026-08-25T14:36:16.250Z

Link: CVE-2026-79792

cve-icon Vulnrichment

Updated: 2026-08-26T14:11:34.950Z

cve-icon NVD

Status : Deferred

Published: 2026-08-25T21:18:23.660

Modified: 2026-08-26T16:19:05.917

Link: CVE-2026-79792

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T14:45:04Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')