EUVD-2026-53209
GHSA-f3j9-9qqv-p4r8
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Local vector with user interaction matches desktop-app threat model; PR:N because no OS privilege is needed to pass arguments; impacts capped at L/L since RCE via --exec was not confirmed.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
1DescriptionCVE.org
xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner.py and downloader.py) by appending the user-provided or scanned URL as a bare trailing positional argument, with no '--' end-of-options marker and no scheme validation anywhere in the codebase. Because yt-dlp parses any argument beginning with '-' as a CLI option rather than link text, a crafted 'URL' value such as -U (yt-dlp's self-update flag) or --exec=... is parsed as a real yt-dlp option instead of a URL, altering the tool's control flow before its own URL validation runs. Full code execution via --exec was not demonstrated in the single-URL flow tested, but the underlying argument-injection primitive is confirmed and unmitigated across all call sites.
AnalysisAI
Argument injection in xidown, a desktop GUI wrapper for yt-dlp and ffmpeg, allows any string beginning with '-' supplied as a URL to be interpreted by yt-dlp as a CLI option rather than a link target, because the application never inserts a '--' end-of-options separator before appending user input to subprocess invocations in scanner.py and downloader.py. All versions under cpe:2.3:a:indravoyager:xidown are affected across every call site. While full code execution via yt-dlp's --exec flag was not demonstrated during testing, the injection primitive is confirmed and unmitigated, placing the theoretical impact ceiling - arbitrary shell command execution - substantially above what the CVSS 4.4 score conveys. No public exploit has been identified and this CVE is not listed in the CISA KEV catalog.
Technical ContextAI
xidown is a GUI application that constructs subprocess calls to yt-dlp (a feature-rich media downloader) and ffmpeg. The flaw (CWE-88: Argument Injection or Modification) arises because Python subprocess invocations in scanner.py and downloader.py append user-supplied or scanned URL strings as bare trailing positional arguments, without inserting the POSIX '--' argument terminator that signals end-of-options to the receiving process. yt-dlp's argparse-based CLI interprets any token beginning with '-' as an option flag before its own URL validation runs, meaning a crafted value such as '-U' (yt-dlp's self-update flag) or '--exec=<shell command>' (which runs arbitrary OS commands after each download) is processed as a genuine CLI directive. The CPE cpe:2.3:a:indravoyager:xidown:*:*:*:*:*:*:*:* covers all released versions, indicating no safe release exists. The root-cause fix is a single two-character insertion ('--') before the URL argument in every yt-dlp invocation.
RemediationAI
No vendor-released patch has been identified at time of analysis. Upstream maintainers should insert a '--' argument separator immediately before the URL argument in every yt-dlp subprocess invocation in scanner.py and downloader.py (e.g., change ['yt-dlp', url] to ['yt-dlp', '--', url]), and add scheme validation to reject any URL that does not begin with a recognized scheme such as 'http://', 'https://', 'ftp://', or a recognized yt-dlp extractor prefix. As a compensating control, users can avoid pasting untrusted or externally provided URL strings into xidown; instead, manually navigate to the source page and copy the URL directly from a trusted browser address bar. This mitigates the social-engineering vector but does not address scanner-derived URLs. If the scanner component processes URLs from untrusted sources (QR codes, clipboard, files), disabling that feature reduces exposure. There are no known workarounds that address the underlying injection at the subprocess level without code changes.
Share
External POC / Exploit Code
Leaving vuln.today