CVE-2026-79792

Name of the Vulnerable Software and Affected Versions zackees transcribe-anything versions prior to 4.1.1

Description A flaw in the Yt-dlp Download component allows remote os command injection. The issue occurs within the ytdlp download() function located in the src/transcribe anything/ytldp download.py file when the url argument is manipulated. OS command injection is a vulnerability that allows an attacker to execute arbitrary operating system commands on the server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the url argument in the ytdlp download() function to minimize the risk of exploitation.