Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2025-43858
Summary
The package YoutubeDLSharp is a wrapper for the command-line video downloaders youtube-dl and yt-dlp. An unsafe conversion of arguments allows the injection of malicious commands when starting "yt-dlp" from a command prompt running on Windows OS, with the "UseWindowsEncodingWorkaround" value set to true (the default behavior). If a user is utilizing the built-in methods from the "YoutubeDL.cs" file, the "UseWindowsEncodingWorkaround" value is true by default, and the user cannot disable it through these methods. This issue affects versions 1.0.0-beta4 through 1.1.1.
- LOW
- LOCAL
- HIGH
- CHANGED
- NONE
- NONE
- HIGH
- LOW
CWE-77 - Command Injection
A command injection attack involves injecting an operating system command through the data input, which gets executed on the host operating system with the privileges of the victimized application. The impact of a command injection attack may range from loss of data confidentiality and integrity to unauthorized remote access to the hosting system. The attack may cause serious data breaches and system takeover.
References
Advisory Timeline
- Published
