Streamvault
Monthly
Authenticated remote code execution affects StreamVault (StreamVault / stream-vault SpiritApplication) releases prior to 251126, where an administrator can inject arbitrary yt-dlp arguments through the /admin/api/saveConfig endpoint. The injected arguments are persisted globally and later concatenated into the yt-dlp command line assembled by YtDlpUtil.java, allowing OS command injection (CWE-78) that executes with the privileges of the StreamVault service when a download job runs. Exploitation requires a valid administrative session (CVSS PR:H), so anonymous remote attackers cannot reach it, but publicly available exploit code exists per the referenced GitHub security advisory GHSA-c747-q388-3v6m; there is no indication of confirmed active exploitation (CISA KEV), and the vulnerable argument-append feature was removed entirely in the subsequent 251226 release.
Authenticated remote code execution affects StreamVault (StreamVault / stream-vault SpiritApplication) releases prior to 251126, where an administrator can inject arbitrary yt-dlp arguments through the /admin/api/saveConfig endpoint. The injected arguments are persisted globally and later concatenated into the yt-dlp command line assembled by YtDlpUtil.java, allowing OS command injection (CWE-78) that executes with the privileges of the StreamVault service when a download job runs. Exploitation requires a valid administrative session (CVSS PR:H), so anonymous remote attackers cannot reach it, but publicly available exploit code exists per the referenced GitHub security advisory GHSA-c747-q388-3v6m; there is no indication of confirmed active exploitation (CISA KEV), and the vulnerable argument-append feature was removed entirely in the subsequent 251226 release.