CVE-2026-6218

MediumCVSS 4.3

Published: 13/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

A vulnerability was found in ytDownloader up to 3.20.2 in the createTextNode function of the Error Details Panel component, leading to cross-site scripting (XSS). The attack may be performed remotely. The vendor was contacted about this disclosure.

Risk Assessment

A remote attacker can execute arbitrary JavaScript in the user's browser, potentially leading to session data theft or actions performed on behalf of the user. This could compromise the security of application users.

Recommendation

Update ytDownloader to a version later than 3.20.2 if the vendor has released a fix. Until then, avoid interacting with untrusted content within the application.

Other vulnerabilities in ytDownloader

CVE-2026-6219Medium
In aandrew-me ytDownloader up to 3.20.2, the child_process.exec function in src/compressor.js (Compressor Feature component) allows command injection. The attack requires local access and the exploit has been publicly disclosed.

Original NVD description (English source)

A vulnerability was found in aandrew-me ytDownloader up to 3.20.2. Affected by this issue is the function createTextNode of the component Error Details Panel. The manipulation results in cross site scripting. The attack may be performed from remote. The vendor was contacted early about this disclosure.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS