CVE-2026-79792

A flaw has been found in zackees transcribe-anything up to 4.1.0. Affected is the function ytdlp_download of the file src/transcribe_anything/ytldp_download.py of the component Yt-dlp Download. This manipulation of the argument url causes os command injection. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

• CWE-77
• CWE-78

• https://github.com/zackees/transcribe-anything/
• https://github.com/zackees/transcribe-anything/issues/137
• https://vuldb.com/cve/CVE-2026-79792
• https://vuldb.com/submit/886398
• https://vuldb.com/vuln/395054
• https://vuldb.com/vuln/395054/cti
• https://vuldb.com/submit/886398

Published

Aug 25, 2026

Last Modified

Aug 26, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-79784Vocos instantiates a class named by a configuration file wit…8.8
• CVE-2026-79785X-AnyLabeling's model downloader disabled TLS certificate ve…5.9
• CVE-2026-79786Coroot's unauthenticated MCP OAuth dynamic client registrati…7.1
• CVE-2026-79787Alluxio's S3 REST proxy fails to verify AWS Signature Versio…9.8
• CVE-2026-79788In Dradis Community Edition, the ProvidersController and Age…7.1
• CVE-2026-7979Inappropriate implementation in Media in Google Chrome prior…4.3
• CVE-2026-79793A vulnerability has been found in code-projects Online Shopp…4.3
• CVE-2026-7980Use after free in WebAudio in Google Chrome prior to 148.0.7…8.8
• CVE-2026-79804A vulnerability was found in SililaWijesinghe Food Ordering …7.3
• CVE-2026-7981Out of bounds read in Codecs in Google Chrome prior to 148.0…8.1
• CVE-2026-7982Uninitialized Use in WebCodecs in Google Chrome prior to 148…6.5
• CVE-2026-7983Out of bounds read in Dawn in Google Chrome prior to 148.0.7…4.3