CVE-2026-79792

mediumCVSS 5.6covered by 1 sourcefirst seen 2026-08-25

A flaw has been found in zackees transcribe-anything up to 4.1.0. Affected is the function ytdlp_download of the file src/transcribe_anything/ytldp_download.py of the component Yt-dlp Download. This manipulation of the argument url causes os command injection. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

⚡ Watch CVE-2026-79792

Get an email if CVE-2026-79792 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

mediumCVE-2026-79792: A flaw has been found in zackees transcribe-anything up to 4.1.0. Affected is the function ytd…nvd · 2026-08-25

External references

NVD record for CVE-2026-79792

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-79792 status](https://www.csirts.com/badge/CVE-2026-79792)](https://www.csirts.com/cve/CVE-2026-79792)