CVE-2026-79792CWE-77CWE-78command-injection

CVE-2026-79792

Medium · published August 26, 2026

CVSS v3.1
5.6
EPSS
2%
Percentile
76.1
In the wild
Unconfirmed
What it is

A flaw has been found in zackees transcribe-anything up to 4.1.0. Affected is the function ytdlp_download of the file src/transcribe_anything/ytldp_download.py of the component Yt-dlp Download. This manipulation of the argument url causes os command injection. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

The record
Technical detail
CVSS v3.1
5.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.01633 · 76.1th percentile
Weaknesses
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-08-26T01:18Z
References (7)
https://github.com/zackees/transcribe-anything/ · [email protected]https://github.com/zackees/transcribe-anything/issues/137 · [email protected]https://vuldb.com/cve/CVE-2026-79792 · [email protected]https://vuldb.com/submit/886398 · [email protected]https://vuldb.com/vuln/395054 · [email protected]https://vuldb.com/vuln/395054/cti · [email protected]https://vuldb.com/submit/886398 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 27 AUG 06:46Z
    EPSS moved — → 1%
    epss
  • 25 AUG 20:30Z
    zackees transcribe-anything Yt-dlp Download ytldp_download.py ytdlp_download os command injection
    cvelistv5