CVE-2026-71212

Summary

xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner.py and downloader.py) by appending the user-provided or scanned URL as a bare trailing positional argument, with no '–' end-of-options marker and no scheme validation anywhere in the codebase.

Affected Software

Weaknesses

• CWE-88: CWE-88 Argument Injection

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://cwe.mitre.org/data/definitions/88.html

• ←Previous
• Next→