Fixed blind SSRF on DIAL auto discovery
Fixes advisory: GHSA-56v3-jrq2-4q9m / CVE-2026-77597
It's recommended for all users to update to this latest version (v2.11.0)
This issue could allow an attacker controlled device on the same lan as iSponsorBlockTV to request an arbitrary URL by abusing the DIAL auto-discovery. It'd be able to either:
- show a debug log line
- __main__ - DEBUG - Discovered device at <attacker controlled URL>, processing...(which is normally disabled and won't be shown in the actual configurator since textual doesn't show logs unless running in dev mode and launching a second terminal to inspect log output), and make a single GET request to an "attacker controlled" url which does not leak any information back to iSponsorBlockTV itself and swallows any sort of error (parsing or an invalid response from not being a real DIAL server) (dial_client.pyL131-L133) - make single POST request to a partly "attacker controlled" url since it'll always have the suffix
/YouTubeappended (dial_client.pyL139) , with predefined headers{"Origin": "https://www.youtube.com","Content-Type": "application/x-www-form-urlencoded",}(dial_client.pyL158-L161) and a predefined payload{"pairingCode": <random 12 digit code>, "theme": "cl"}which also does not leak any information back to iSponsorBlockTV itself and swallows any sort of error (parsing or an invalid response from not being a real DIAL server with a YouTube app running on it) (dial_client.pyL162).
Thanks to the user that reported this vulnerability (they appear to have deactivated their GitHub account since, I won't mention them publicly unless they are OK with it just in case).
What's Changed
- Bump pyytlounge from 3.2.0 to 3.3.0 by @dependabot[bot] in #486
- Bump aiohttp from 3.14.1 to 3.14.3 by @dependabot[bot] in #487
- Bump yarl from 1.24.2 to 1.24.5 by @dependabot[bot] in #488
- Bump actions/setup-python from 6 to 7 in the all group by @dependabot[bot] in #485
Full Changelog: v2.10.0...v2.11.0
Contributors
dependabot