EUVD-2026-22118
GHSA-h9w8-rqc4-pg9w
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only attack vector (AV:L) and low-privilege requirement (PR:L) are grounded in description; partial C/I/A impact with no scope change aligns with SSVC technical impact 'partial'.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability was determined in aandrew-me ytDownloader up to 3.20.2. This affects the function child_process.exec of the file src/compressor.js of the component Compressor Feature. This manipulation causes command injection. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
AnalysisAI
Command injection in ytDownloader's Compressor Feature (versions up to and including 3.20.2) allows a local low-privileged attacker to execute arbitrary OS commands by supplying shell-metacharacter-laden input to the unsanitized child_process.exec() call in src/compressor.js. A proof-of-concept exploit video has been publicly released by researcher ngocnn97 on GitHub. Despite POC availability, SSVC rates exploitation as 'none' and EPSS sits at 0.18% (39th percentile), reflecting limited real-world risk due to the mandatory local access requirement and the product's narrow deployment footprint.
Technical ContextAI
ytDownloader (CPE: cpe:2.3:a:aandrew-me:ytdownloader:*:*:*:*:*:*:*:*) is an open-source desktop application for downloading online video and audio. The vulnerable component is the Compressor Feature, implemented in src/compressor.js, which uses Node.js's child_process.exec() to invoke system-level commands. CWE-77 (Improper Neutralization of Special Elements Used in a Command) describes this root cause: child_process.exec() passes its argument to the OS shell, making it inherently injectable when user-controlled values are concatenated into the command string without sanitization. The safer Node.js alternatives - child_process.execFile() or child_process.spawn() with argument arrays - bypass shell interpretation entirely and would eliminate this attack surface.
RemediationAI
No vendor-released patched version has been identified at time of analysis; the vendor was contacted prior to public disclosure per the VulDB report at https://vuldb.com/vuln/357140, but no fix version is confirmed. Users should monitor the aandrew-me/ytDownloader project repository for a patched release and upgrade as soon as one becomes available. As an interim compensating control, restrict ytDownloader usage to single-user, trusted-user-only environments and avoid deploying the application in shared or multi-user desktop contexts where untrusted local accounts exist. For project maintainers, the direct fix is to replace child_process.exec() in src/compressor.js with child_process.execFile() or child_process.spawn() using argument arrays rather than shell-interpolated strings, and to validate and sanitize all user-supplied values before they reach any command-execution call.
More in Ytdownloader
View allSame weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today