Xidown
Monthly
Argument injection in xidown, a desktop GUI wrapper for yt-dlp and ffmpeg, allows any string beginning with '-' supplied as a URL to be interpreted by yt-dlp as a CLI option rather than a link target, because the application never inserts a '--' end-of-options separator before appending user input to subprocess invocations in scanner.py and downloader.py. All versions under cpe:2.3:a:indravoyager:xidown are affected across every call site. While full code execution via yt-dlp's --exec flag was not demonstrated during testing, the injection primitive is confirmed and unmitigated, placing the theoretical impact ceiling - arbitrary shell command execution - substantially above what the CVSS 4.4 score conveys. No public exploit has been identified and this CVE is not listed in the CISA KEV catalog.
Argument injection in xidown, a desktop GUI wrapper for yt-dlp and ffmpeg, allows any string beginning with '-' supplied as a URL to be interpreted by yt-dlp as a CLI option rather than a link target, because the application never inserts a '--' end-of-options separator before appending user input to subprocess invocations in scanner.py and downloader.py. All versions under cpe:2.3:a:indravoyager:xidown are affected across every call site. While full code execution via yt-dlp's --exec flag was not demonstrated during testing, the injection primitive is confirmed and unmitigated, placing the theoretical impact ceiling - arbitrary shell command execution - substantially above what the CVSS 4.4 score conveys. No public exploit has been identified and this CVE is not listed in the CISA KEV catalog.