iSponsorBlockTV Updates & Release Notes

Fixed blind SSRF on DIAL auto discovery

Fixes advisory: GHSA-56v3-jrq2-4q9m / CVE-2026-77597

It's recommended for all users to update to this latest version (v2.11.0)

This issue could allow an attacker controlled device on the same lan as iSponsorBlockTV to request an arbitrary URL by abusing the DIAL auto-discovery. It'd be able to either:

show a debug log line - main - DEBUG - Discovered device at <attacker controlled URL>, processing... (which is normally disabled and won't be shown in the actual configurator since textual doesn't show logs unless running in dev mode and launching a second terminal to inspect log output), and make a single GET request to an "attacker controlled" url which does not leak any information back to iSponsorBlockTV itself and swallows any sort of error (parsing or an invalid response from not being a real DIAL server) (dial_client.py L131-L133)

make single POST request to a partly "attacker controlled" url since it'll always have the suffix /YouTube appended (dial_client.py L139) , with predefined headers {"Origin": "https://www.youtube.com","Content-Type": "application/x-www-form-urlencoded",} (dial_client.py L158-L161) and a predefined payload {"pairingCode": <random 12 digit code>, "theme": "cl"} which also does not leak any information back to iSponsorBlockTV itself and swallows any sort of error (parsing or an invalid response from not being a real DIAL server with a YouTube app running on it) (dial_client.py L162).

Thanks to the user that reported this vulnerability (they appear to have deactivated their GitHub account since, I won't mention them publicly unless they are OK with it just in case).

What's Changed

• Bump pyytlounge from 3.2.0 to 3.3.0 by @dependabot[bot] in #486
• Bump aiohttp from 3.14.1 to 3.14.3 by @dependabot[bot] in #487
• Bump yarl from 1.24.2 to 1.24.5 by @dependabot[bot] in #488
• Bump actions/setup-python from 6 to 7 in the all group by @dependabot[bot] in #485

Full Changelog: v2.10.0...v2.11.0

What's Changed

• Reuse per-instance web_session and api_helper by @dmunozv04 in #466
• Fix cli configurator on python3.14 by @dmunozv04 in #473
• Remove poi_highlight from configurators by @colord in #464
• Add 'Hook' category; and clarify 'Preview' label by @jicetus in #467
• Port PyytLounge to v3.2.0 by @sternma in #399
• Bump textual from 8.2.5 to 8.2.7 by @dependabot[bot] in #465
• Bump rich-click from 1.9.7 to 1.9.8 by @dependabot[bot] in #468
• Allow changing the SponsorBlock API URL by @SamyDjemai in #470
• Bump actions/checkout from 6 to 7 in the all group across 1 directory by @dependabot[bot] in #475
• Bump yarl from 1.23.0 to 1.24.2 by @dependabot[bot] in #477
• Bump aiohttp from 3.13.5 to 3.14.1 by @dependabot[bot] in #479
• Bump zeroconf from 0.148.0 to 0.150.0 by @dependabot[bot] in #478
• Bump pychromecast from 14.0.7 to 14.0.10 by @dependabot[bot] in #481
• Bump textual from 8.2.7 to 8.2.8 by @dependabot[bot] in #482

New Contributors

• @colord made their first contribution in #464
• @jicetus made their first contribution in #467
• @SamyDjemai made their first contribution in #470

Full Changelog: v2.9.0...v2.10.0

Warning

YouTube has changed the screen ID format from 26 characters to 64 hex digits. Since the 15th April 2026 YouTube apps have started generating new IDs and revoking the old ones, breaking a paired iSponsorBlockTV.

The solution is simple, pairing the device again will (most likely) fix this.

Read more info on #450 and https://github.com/dmunozv04/iSponsorBlockTV/wiki/new-screen-ID-format

What's Changed

• Bump aiohttp from 3.12.15 to 3.13.5 by @dependabot[bot] in #440
• Bump rich from 14.3.3 to 14.3.4 by @dependabot[bot] in #444
• Bump xmltodict from 0.15.1 to 1.0.4 by @dependabot[bot] in #425
• Bump softprops/action-gh-release from 2 to 3 in the all group by @dependabot[bot] in #449
• Add warning for deprecated screen ID format by @dmunozv04 in #455

v2.8.0 not published on PyPI

Full Changelog: v2.7.0...v2.8.1

Warning

YouTube has changed the screen ID format from 26 characters to 64 hex digits. Since the 15th April 2026 YouTube apps have started generating new IDs and revoking the old ones, breaking a paired iSponsorBlockTV.

The solution is simple, pairing the device again will (most likely) fix this.

Read more info on #450 and https://github.com/dmunozv04/iSponsorBlockTV/wiki/new-screen-ID-format

What's Changed

• Bump aiohttp from 3.12.15 to 3.13.5 by @dependabot[bot] in #440
• Bump rich from 14.3.3 to 14.3.4 by @dependabot[bot] in #444
• Bump xmltodict from 0.15.1 to 1.0.4 by @dependabot[bot] in #425
• Bump softprops/action-gh-release from 2 to 3 in the all group by @dependabot[bot] in #449
• Add warning for deprecated screen ID format by @dmunozv04 in #455

Full Changelog: v2.7.0...v2.8.0

Main Changes

Improvements to setup messages, now respecting empty skip categories

What's Changed

• Bump actions/checkout from 5 to 6 by @dependabot[bot] in #387
• Bump actions/upload-artifact from 4 to 5 by @dependabot[bot] in #382
• Bump actions/download-artifact from 5 to 6 by @dependabot[bot] in #383
• Bump actions/download-artifact from 6 to 8 by @dependabot[bot] in #413
• Bump actions/attest-build-provenance from 3 to 4 by @dependabot[bot] in #414
• Bump actions/upload-artifact from 5 to 7 by @dependabot[bot] in #415
• Fix: unclear setup messages and warnings outside of normal docker config flow by @sternma in #405
• Bump docker/build-push-action from 6 to 7 by @dependabot[bot] in #416
• Bump docker/login-action from 3 to 4 by @dependabot[bot] in #417
• Bump docker/setup-qemu-action from 3 to 4 by @dependabot[bot] in #418
• Bump docker/metadata-action from 5 to 6 by @dependabot[bot] in #419
• Bump docker/setup-buildx-action from 3 to 4 by @dependabot[bot] in #420
• Add pre-commit to dependabot by @dmunozv04 in #421
• Bump https://github.com/astral-sh/ruff-pre-commit from v0.12.12 to 0.15.5 by @dependabot[bot] in #422
• Dependabot pre commit by @dmunozv04 in #436
• Bump rich-click from 1.8.9 to 1.9.7 by @dependabot[bot] in #426
• Bump textual from 5.3.0 to 8.2.3 by @dependabot[bot] in #439
• Respect empty skip categories instead of forcing sponsor default by @Hybirdss in #437

New Contributors

• @Hybirdss made their first contribution in #437

Full Changelog: v2.6.1...v2.7.0

What's Changed

Update ci by @dmunozv04 in #347
Add support for legacy architectures (i386 and armv6) in Docker by @gaiar in #345
Only login to dockerhub if username is provided via secret by @dmunozv04 in #348
Bump aiohttp from 3.12.14 to 3.12.15 by @dependabot[bot] in #341
Bump actions/checkout from 4 to 5 by @dependabot[bot] in #342
Bump actions/setup-python from 5 to 6 by @dependabot[bot] in #354
Bump actions/attest-build-provenance from 2 to 3 by @dependabot[bot] in #353
Bump actions/download-artifact from 4 to 5 by @dependabot[bot] in #343
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #340
Bump xmltodict from 0.14.2 to 0.15.1 by @dependabot[bot] in #350
Bump ssdp from 1.3.0 to 1.3.1 by @dependabot[bot] in #351
Add semver tags to docker build by @dmunozv04 in #358
Update docker-compose.yml by @Wobak in #359
Clarify ad muting not working when using airplay by @dmunozv04 in #362
Bump peter-evans/dockerhub-description from 4 to 5 by @dependabot[bot] in #374

New Contributors

@gaiar made their first contribution in #345
@Wobak made their first contribution in #359

Full Changelog: v2...v2.6.1

Thanks!

Thank you for 3.5k stars and 910K ghcr.io pulls!

Thanks for checking the project out and helping out with an upvote on reddit, a star or a donation! They're all greatly appreciated

What's Changed

• Added proxy support by @desofity in #334
• Bump aiohttp from 3.11.18 to 3.12.14 by @dependabot[bot] in #333
• Bump rich-click from 1.8.8 to 1.8.9 by @dependabot[bot] in #307
• Bump rich from 14.0.0 to 14.1.0 by @dependabot[bot] in #336
• Bump textual from 2.1.2 to 5.0.1 by @dependabot[bot] in #337
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #303

New Contributors

• @desofity made their first contribution in #334

Full Changelog: v2.5.3...v2.6.0