CVE-2026-71212 — xidown - Argument Injection via Unterminated yt-dlp Command Line Construction

CVE-2026-71212

xidown - Argument Injection via Unterminated yt-dlp Command Line Construction PUBLISHED

Description (CNA)

xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner.py and downloader.py) by appending the user-provided or scanned URL as a bare trailing positional argument, with no '--' end-of-options marker and no scheme validation anywhere in the codebase.

Affected (CNA)

Vendor / product	Versions
indravoyager / xidown	affected 0 through 1.25.1.19

CWE

CWE-88

References

https://cwe.mitre.org/data/definitions/88.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.