What is the CVSS score of CVE-2025-43858?

CVE-2025-43858 has a CVSS 3.1 base score of 9.2 (Critical). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.2%.

Which versions of Windows are affected by CVE-2025-43858?

Organizations using versions starting from 1.0.0-beta4 and face critical risk from CVE-2025-43858, a command injection vulnerability rated CVSS 9.2.. A patch is available.

How to fix or mitigate CVE-2025-43858?

Within 24 hours: Identify all affected systems running versions starting from 1.0.0-beta4 and and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

Windows CVE-2025-43858

CRITICAL

Command Injection (CWE-77)

2025-04-24 security-advisories@github.com

Windows Command Injection Microsoft

9.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.2 CRITICAL

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 28, 2026 - 18:38 vuln.today

CVE Published

Apr 24, 2025 - 18:15 nvd

CRITICAL 9.2

DescriptionGitHub Advisory

YoutubeDLSharp is a wrapper for the command-line video downloaders youtube-dl and yt-dlp. In versions starting from 1.0.0-beta4 and prior to 1.1.2, an unsafe conversion of arguments allows the injection of a malicious commands when starting yt-dlp from a commands prompt running on Windows OS with the UseWindowsEncodingWorkaround value defined to true (default behavior). If a user is using built-in methods from the YoutubeDL.cs file, the value is true by default and a user cannot disable it from these methods. This issue has been patched in version 1.1.2.

AnalysisAI

YoutubeDLSharp is a wrapper for the command-line video downloaders youtube-dl and yt-dlp. Rated critical severity (CVSS 9.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Command Injection (CWE-77), which allows attackers to inject arbitrary commands into system command execution. YoutubeDLSharp is a wrapper for the command-line video downloaders youtube-dl and yt-dlp. In versions starting from 1.0.0-beta4 and prior to 1.1.2, an unsafe conversion of arguments allows the injection of a malicious commands when starting yt-dlp from a commands prompt running on Windows OS with the UseWindowsEncodingWorkaround value defined to true (default behavior). If a user is using built-in methods from the YoutubeDL.cs file, the value is true by default and a user cannot disable it from these methods. This issue has been patched in version 1.1.2. Version information: prior to 1.1.2.

Affected ProductsAI

See vendor advisory for affected versions.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized APIs, avoid shell execution, validate input with strict allowlists.