{"id":"CVE-2026-62968","kind":"vulnerability","aliases":["CVE-2026-62968"],"related":[],"title":"Dream Displays: user input can inject yt-dlp command-line options","description":"Dream Displays provides in-game screens for streaming videos in Minecraft. From 1.5.0 until 1.8.2, user-controlled input can influence arguments passed to `yt-dlp` under specific conditions. Unintended command-line options may be interpreted by `yt-dlp`, potentially altering its behavior. This issue is fixed in version 1.8.2.","summary":"Dream Displays, a Minecraft mod that shows streamed videos on in-game screens, passes user-controlled input to the yt-dlp command-line tool. Attacker-supplied text can be read as yt-dlp options, which can change how the tool behaves.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dream-displays","minecraft","package","yt-dlp"],"not_affected_if":["version-1.8.2-or-later"],"how_to_check":"- Check the installed Dream Displays mod version in the Minecraft mods folder or launcher.","fix":"- Dream Displays: move to `1.8.2`.","status":"open","published_at":"2026-10-30T21:17:15+00:00","first_seen_at":"2026-10-30T21:25:53+00:00","triaged_at":"2026-10-30T21:26:32+00:00","updated_at":"2026-10-30T21:26:32+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T21:26:32Z","model":"claude-haiku-5-5","output":{"fix":"- Dream Displays: move to `1.8.2`.","reach":"unknown","title":"Dream Displays: user input can inject yt-dlp command-line options","impact":"medium","summary":"Dream Displays, a Minecraft mod that shows streamed videos on in-game screens, passes user-controlled input to the yt-dlp command-line tool. Attacker-supplied text can be read as yt-dlp options, which can change how the tool behaves.","audience":"everyone","category":"package","nicknames":[],"who_cares":["minecraft","dream-displays","yt-dlp"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown: argument injection may alter yt-dlp behavior","analyst_note":"Check the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-62968) and the project's release notes to confirm the trigger conditions and what an attacker can achieve through yt-dlp.","how_to_check":"- Check the installed Dream Displays mod version in the Minecraft mods folder or launcher.\n- Unknown whether the sources give further checks.","plain_action":"Update the Dream Displays mod for Minecraft to version 1.8.2 or later.","needs_analyst":true,"not_affected_if":["version-1.8.2-or-later"],"who_is_affected":"Affects Dream Displays versions from 1.5.0 up to 1.8.2 where user input reaches yt-dlp arguments under specific conditions. The sources do not describe the exact conditions. Players and servers not running Dream Displays in that range are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000711,"input_tokens":4134,"output_tokens":595,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-62968':16A,19A '1.5.0':88C '1.8.2':90C,128C 'alter':119C 'argument':97C 'attack':57B 'attacker-suppli':56B 'behav':74B 'behavior':121C 'chang':70B 'command':11A,53B,108C 'command-lin':10A,52B,107C 'condit':105C 'control':45B,93C 'cve':14A,17A 'display':2A,22B,29B,76C 'dlp':9A,27B,51B,66B,102C,117C 'dream':1A,21B,28B,75C 'dream-display':20B 'fix':125C 'game':40B,80C 'in-gam':38B,78C 'influenc':96C 'inject':6A 'input':4A,46B,94C 'interpret':113C 'issu':123C 'line':12A,54B,109C 'may':111C 'minecraft':23B,31B,86C 'mod':32B 'option':13A,67B,110C 'packag':24B 'pass':42B,98C 'potenti':118C 'provid':77C 'read':62B 'screen':41B,81C 'show':34B 'specif':104C 'stream':35B,83C 'suppli':58B 'text':59B 'tool':55B,73B 'unintend':106C 'user':3A,44B,92C 'user-control':43B,91C 'version':127C 'video':36B,84C 'yt':8A,26B,50B,65B,101C,116C 'yt-dlp':7A,25B,49B,64B,100C,115C","nicknames":[],"mitigations":[],"who_affected":"Affects Dream Displays versions from 1.5.0 up to 1.8.2 where user input reaches yt-dlp arguments under specific conditions. The sources do not describe the exact conditions. Players and servers not running Dream Displays in that range are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update the Dream Displays mod for Minecraft to version 1.8.2 or later.","first_public_at":"2026-10-30T21:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62968","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62968","severity":null,"published_at":"2026-10-30T21:17:15+00:00","modified_at":"2026-10-30T21:17:15+00:00","first_seen_at":"2026-10-30T21:25:53+00:00","fetched_at":"2026-10-30T21:25:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}