Command-line argument injection in Dream Displays yt-dlp invocation
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-88.
Summary
Dream Displays, which provides in-game screens for streaming videos in Minecraft, is affected from 1.5.0 before 1.8.2. User-controlled input can influence arguments passed to yt-dlp under specific conditions, so unintended command-line options may be interpreted by yt-dlp (CWE-88). An unauthenticated remote attacker can alter yt-dlp behavior through network-reachable input without user interaction, with a high impact on integrity.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
Dream Displays provides in-game screens for streaming videos in Minecraft. From 1.5.0 until 1.8.2, user-controlled input can influence arguments passed to `yt-dlp` under specific conditions. Unintended command-line options may be interpreted by `yt-dlp`, potentially altering its behavior. This issue is fixed in version 1.8.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| arsmotorin | dreamdisplays | 1.5.0 to before 1.8.2 | 1.8.2 | Patch available | CNA |
- dreamdisplays Vendorarsmotorin Affected 1.5.0 to before 1.8.2 Fixed in 1.8.2 Patch available CNA
Remediation
Update arsmotorin dreamdisplays to version 1.8.2, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
- Fix · CNA dreamdisplays (arsmotorin) Fixed in 1.8.2
Timeline
- 2026-10-30 Threatist record created from CVE-2026-62968
- 2026-10-30 CISA SSVC decision points changed
References
Other 5
- https://github.com/arnodoelinger/dreamdisplays/security/advisories/GHSA-5j65-hvgq-c585
- https://github.com/arnodoelinger/dreamdisplays/commit/ee8702bdbebcb2eb562c8acfb55c6bc383943b94
- https://github.com/arnodoelinger/dreamdisplays/blob/v1.10.0-preview.1/media/source/src/main/kotlin/com/dreamdisplays/media/source/youtube/YtDlp.kt
- https://github.com/arnodoelinger/dreamdisplays/blob/v1.10.0-preview.1/media/source/src/main/kotlin/com/dreamdisplays/media/source/youtube/process/YtDlpClientRace.kt
- https://github.com/arnodoelinger/dreamdisplays/releases/tag/v1.8.2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences