Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2026-6218: ytDownloader Version 3.20.2 Allows Malicious Code to Run on Your Site
CVE-2026-6218 · published 6 months ago
Summary
A security flaw in the ytDownloader software, versions up to 3.20.2, could allow an attacker to inject malicious code into your website. This could potentially lead to unauthorized actions on your site. We recommend updating to the latest version to fix this issue.
Original advisory text
A vulnerability was found in aandrew-me ytDownloader up to 3.20.2. Affected by this issue is the function createTextNode of the component Error Details Panel. The manipulation results in cross site...
A vulnerability was found in aandrew-me ytDownloader up to 3.20.2. Affected by this issue is the function createTextNode of the component Error Details Panel. The manipulation results in cross site scripting. The attack may be performed from remote. The vendor was contacted early about this disclosure.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
CWE-94Code Injection
Timeline
Published13 Apr 2026
Updated3 Nov 2026
First seen13 Apr 2026
Sources
CVE-2026-6218 · NVD
Track software like this
Free during beta