CVE-2026-6218

MEDIUM

aandrew-me ytDownloader Error Details Panel createTextNode cross site scripting

Title source: cna
STIX 2.1

Description

A vulnerability was found in aandrew-me ytDownloader up to 3.20.2. Affected by this issue is the function createTextNode of the component Error Details Panel. The manipulation results in cross site scripting. The attack may be performed from remote. The vendor was contacted early about this disclosure.

References (4)

Core 4
Core References
Third Party Advisory third-party-advisory
Submit #785842 | Aandrew-me ytDownloader 3.20.2 Remote code execution via DOM XSS
https://vuldb.com/submit/785842
Vdb Entry, Technical Description vdb-entry technical-description
VDB-357139 | aandrew-me ytDownloader Error Details Panel createTextNode cross site scripting
https://vuldb.com/vuln/357139
Signature, Permissions Required signature permissions-required
VDB-357139 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/357139/cti

Scores

CVSS v3 4.3
EPSS 0.0028
EPSS Percentile 19.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79 CWE-94
Status published
Products (3)
aandrew-me/ytDownloader 3.20.0
aandrew-me/ytDownloader 3.20.1
aandrew-me/ytDownloader 3.20.2
Published Apr 13, 2026
Tracked Since Apr 14, 2026