Riskcovery

CVE-2025-43858

YoutubeDLSharp allows command injection on windows system due to non sanitized arguments

State
Published
Severity
9.2 Critical
Published
Apr 24, 2025
Updated
Apr 24, 2025
Reserved
Apr 17, 2025

Read the record on cve.org

Description

YoutubeDLSharp is a wrapper for the command-line video downloaders youtube-dl and yt-dlp. In versions starting from 1.0.0-beta4 and prior to 1.1.2, an unsafe conversion of arguments allows the injection of a malicious commands when starting `yt-dlp` from a commands prompt running on Windows OS with the `UseWindowsEncodingWorkaround` value defined to true (default behavior). If a user is using built-in methods from the YoutubeDL.cs file, the value is true by default and a user cannot disable it from these methods. This issue has been patched in version 1.1.2.

Scores

CVSSScoreVectorSource
3.19.2 CriticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:LGitHub_M

Weaknesses

  • CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

ProductVersions
YoutubeDLSharpBluegrams
  • >= 1.0.0-beta4, < 1.1.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.