Server-side request forgery in alexta69 MeTube feed metadata handler
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
MeTube by alexta69 from 2026.09.0 up to and including 2026.09.28 contains a flaw in DownloadQueue.__write_feed_metadata_sync in app/ytdl.py. The feed metadata thumbnail fetch lets an attacker force the server to send requests, a server-side request forgery (CWE-918). A remote attacker without privileges or user interaction can trigger it, but the source describes exploitation as highly complex and difficult, with low impact on confidentiality, integrity and availability. The exploit has been publicly disclosed and a public exploit is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28. This vulnerability affects the function DownloadQueue.__write_feed_metadata_sync of the file app/ytdl.py of the component Feed-metadata Thumbnail Fetch Handler. Such manipulation leads to server-side request forgery. The attack may be launched remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.09.29 is able to resolve this issue. The name of the patch is a3896604540223ecbb8258b41b1d745d62647d16. It is suggested to upgrade the affected component.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| alexta69 | MeTube | 2026.09.0; 2026.09.1; 2026.09.2; 2026.09.3; 2026.09.4; 2026.09.5; 2026.09.6; 2026.09.7; 2026.09.8; 2026.09.9; 2026.09.10; 2026.09.11; 2026.09.12; 2026.09.13; 2026.09.14; 2026.09.15; 2026.09.16; 2026.09.17; 2026.09.18; 2026.09.19; 2026.09.20; 2026.09.21; 2026.09.22; 2026.09.23; 2026.09.24; 2026.09.25; 2026.09.26; 2026.09.27; 2026.09.28 | 2026.09.29 | Patch available | CNA |
- MeTube Vendoralexta69 Affected 2026.09.0; 2026.09.1; 2026.09.2; 2026.09.3; 2026.09.4; 2026.09.5; 2026.09.6; 2026.09.7; 2026.09.8; 2026.09.9; 2026.09.10; 2026.09.11; 2026.09.12; 2026.09.13; 2026.09.14; 2026.09.15; 2026.09.16; 2026.09.17; 2026.09.18; 2026.09.19; 2026.09.20; 2026.09.21; 2026.09.22; 2026.09.23; 2026.09.24; 2026.09.25; 2026.09.26; 2026.09.27; 2026.09.28 Fixed in 2026.09.29 Patch available CNA
Remediation
Upgrade MeTube to version 2026.09.29, which fixes the issue with patch a3896604540223ecbb8258b41b1d745d62647d16.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA MeTube (alexta69) Fixed in 2026.09.29
Timeline
- 2026-10-19 Threatist record created from CVE-2026-112076
- 2026-10-19 Alias added: GHSA-g899-4284-8gqj
- 2026-10-19 CISA SSVC decision points changed
References
More alexta69 vulnerabilities
- TI-2026-54292 alexta69 MeTube Cookie File cookies.txt file access CVSS 4.0MEDIUM 6.9
- TI-2026-06664 alexta69 MeTube CORS Policy main.py on_prepare cross-domain policy CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-112076 · CVE Program
- CVE-2026-112076 · NVD
- FIRST EPSS
- GHSA-g899-4284-8gqj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences