Ytdownloader
Monthly
Command injection in ytDownloader's Compressor Feature (versions up to and including 3.20.2) allows a local low-privileged attacker to execute arbitrary OS commands by supplying shell-metacharacter-laden input to the unsanitized `child_process.exec()` call in `src/compressor.js`. A proof-of-concept exploit video has been publicly released by researcher ngocnn97 on GitHub. Despite POC availability, SSVC rates exploitation as 'none' and EPSS sits at 0.18% (39th percentile), reflecting limited real-world risk due to the mandatory local access requirement and the product's narrow deployment footprint.
Cross-site scripting in ytDownloader up to 3.20.2 allows remote content to inject malicious scripts through the Error Details Panel via the createTextNode function. Versions 3.20.0 through 3.20.2 are confirmed affected per EUVD. A publicly available proof-of-concept titled 'XSS_To_RCE_PoC' strongly suggests the XSS is exploitable as a stepping stone to remote code execution in the likely Electron-based application environment, making the CVSS 5.3 score a probable underestimate of real-world impact. No public exploit confirmation via CISA KEV exists; exploitation requires passive user interaction.
Command injection in ytDownloader's Compressor Feature (versions up to and including 3.20.2) allows a local low-privileged attacker to execute arbitrary OS commands by supplying shell-metacharacter-laden input to the unsanitized `child_process.exec()` call in `src/compressor.js`. A proof-of-concept exploit video has been publicly released by researcher ngocnn97 on GitHub. Despite POC availability, SSVC rates exploitation as 'none' and EPSS sits at 0.18% (39th percentile), reflecting limited real-world risk due to the mandatory local access requirement and the product's narrow deployment footprint.
Cross-site scripting in ytDownloader up to 3.20.2 allows remote content to inject malicious scripts through the Error Details Panel via the createTextNode function. Versions 3.20.0 through 3.20.2 are confirmed affected per EUVD. A publicly available proof-of-concept titled 'XSS_To_RCE_PoC' strongly suggests the XSS is exploitable as a stepping stone to remote code execution in the likely Electron-based application environment, making the CVSS 5.3 score a probable underestimate of real-world impact. No public exploit confirmation via CISA KEV exists; exploitation requires passive user interaction.