EUVD-2026-22089Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-sourced XSS with required passive user interaction, scope change due to script execution in privileged Electron renderer; no availability or direct confidentiality breach confirmed.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in aandrew-me ytDownloader up to 3.20.2. Affected by this issue is the function createTextNode of the component Error Details Panel. The manipulation results in cross site scripting. The attack may be performed from remote. The vendor was contacted early about this disclosure.
AnalysisAI
Cross-site scripting in ytDownloader up to 3.20.2 allows remote content to inject malicious scripts through the Error Details Panel via the createTextNode function. Versions 3.20.0 through 3.20.2 are confirmed affected per EUVD. A publicly available proof-of-concept titled 'XSS_To_RCE_PoC' strongly suggests the XSS is exploitable as a stepping stone to remote code execution in the likely Electron-based application environment, making the CVSS 5.3 score a probable underestimate of real-world impact. No public exploit confirmation via CISA KEV exists; exploitation requires passive user interaction.
Technical ContextAI
ytDownloader (CPE: cpe:2.3:a:aandrew-me:ytdownloader:*:*:*:*:*:*:*:*) is a desktop video downloader application. Desktop download utilities of this type are commonly built on Electron, which renders web content in a Chromium context with optional Node.js integration. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause - the createTextNode function in the Error Details Panel component fails to sanitize externally sourced content before rendering it. While createTextNode is ordinarily a safe DOM API, the data it processes appears to be introduced into a rendering context that permits script execution, indicating misuse of the DOM construction pattern or secondary injection. In Electron applications where contextIsolation is disabled or nodeIntegration is enabled, XSS vulnerabilities are known to escalate to OS-level RCE, a pattern directly referenced by the PoC artifact title.
RemediationAI
No vendor-released patched version has been confirmed at time of analysis. The vendor was notified early per the CVE description, but no advisory URL pointing to a fixed release is present in the reference set. Users should monitor the VulDB advisory at https://vuldb.com/vuln/357139 and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-6218 for patch availability. As an interim compensating control, avoid using ytDownloader to process content from untrusted or unfamiliar sources, as the Error Details Panel appears to render error metadata sourced from external content. If the application is Electron-based, users can assess whether a newer build with corrected Electron security defaults (contextIsolation enabled, nodeIntegration disabled) mitigates the XSS-to-RCE escalation path, though this does not address the underlying XSS. Uninstalling the application until a patch is confirmed is the most conservative option given the potential RCE chain.
More in Ytdownloader
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today