CVE-2026-62968CWE-88

Dream Displays has command-line argument injection in yt-dlp invocation

High · published October 30, 2026

CVSS v4.0
8.7
EPSS
—
In the wild
Unconfirmed
What it is

Dream Displays provides in-game screens for streaming videos in Minecraft. From 1.5.0 until 1.8.2, user-controlled input can influence arguments passed to `yt-dlp` under specific conditions. Unintended command-line options may be interpreted by `yt-dlp`, potentially altering its behavior. This issue is fixed in version 1.8.2.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
Not scored
Weakness
CWE-88 · Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Published
2026-10-30T20:43Z
Timeline
  • 30 OCT 20:43Z
    Dream Displays has command-line argument injection in yt-dlp invocation
    cvelistv5
  • 30 OCT 20:43Z
    Dream Displays has command-line argument injection in yt-dlp invocation
    cvelistv5