Description (CNA)
StreamVault is a video download integration solution. Prior to version 251126, a Remote Code Execution (RCE) vulnerability exists in the stream-vault application (SpiritApplication). The application allows administrators to configure yt-dlp arguments via the /admin/api/saveConfig endpoint without sufficient validation. These arguments are stored globally and subsequently used in YtDlpUtil.java when constructing the command line to execute yt-dlp. This issue has been patched in version 251126.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| lemon8866 / StreamVault | affected < 251126 |
CWE
CWE-78
References
- https://github.com/lemon8866/StreamVault/security/advisories/GHSA-c747-q388-3v6m
- https://github.com/lemon8866/StreamVault/releases/tag/251226
ADP enrichment
No English description supplied.
No references supplied.