CVE-2026-7581
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
alexta69 MeTube up to 2026.04.09 contains a vulnerability in the on_prepare function in app/main.py related to CORS policy. The manipulation leads to a permissive cross-domain policy with untrusted domains. The exploit has been publicly disclosed and fixed in version 2026.04.10.
Risk Assessment
Untrusted domains may access application resources in the user's browser context. The publicly available exploit increases the risk of abuse.
Recommendation
Upgrade MeTube to version 2026.04.10 or later. Review CORS header configuration and restrict allowed origins.
Other vulnerabilities in MeTube
See all- CVE-2026-112076Medium
A vulnerability was detected in alexta69 MeTube in the DownloadQueue.__write_feed_metadata_sync function of app/ytdl.py, related to feed-metadata thumbnail fetching. Manipulation leads to server-side request forgery, and the attack may be launched remotely though it is highly complex. The issue is fixed in version 2026.09.29 (commit a3896604540223ecbb8258b41b1d745d62647d16).
- CVE-2026-78051Medium
A vulnerability was found in alexta69 MeTube up to 2026.06.10. An unknown function in the file /download/.metube/cookies.txt of the Cookie File Handler component allows files or directories to be accessible. The attack can be initiated remotely, and the exploit has been publicly disclosed. Upgrading to version 2026.06.20 resolves the issue.
Original NVD description (English source)
A security vulnerability has been detected in alexta69 MeTube up to 2026.04.09. This affects the function on_prepare of the file app/main.py of the component CORS Policy. The manipulation leads to permissive cross-domain policy with untrusted domains. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.04.10 is able to mitigate this issue. The identifier of the patch is 0072d3488ae5b8d922d3ee87458d829993742a32. It is recommended to upgrade the affected component.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS