CVE-2026-6218
aandrew-me ytDownloader Error Details Panel createTextNode cross site scripting
- State
- Published
- Severity
- 5.3 Medium
- Published
- Apr 13, 2026
- Updated
- Apr 14, 2026
- Reserved
- Apr 13, 2026
Description
A vulnerability was found in aandrew-me ytDownloader up to 3.20.2. Affected by this issue is the function createTextNode of the component Error Details Panel. The manipulation results in cross site scripting. The attack may be performed from remote. The vendor was contacted early about this disclosure.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X | VulDB |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R | VulDB |
| 3.0 | 4.3 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R | VulDB |
| 2.0 | 5.0 Medium | AV:N/AC:L/Au:N/C:N/I:P/A:N/E:ND/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
ytDownloaderaandrew-me |
|
References
- VDB-357139 | aandrew-me ytDownloader Error Details Panel createTextNode cross site scriptingvdb-entrytechnical-description
- VDB-357139 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #785842 | Aandrew-me ytDownloader 3.20.2 Remote code execution via DOM XSSthird-party-advisory
- https://github.com/ngocnn97/security-advisories/blob/main/YtDownloader_XSS_To_RCE_PoC.mp4exploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.