CVE-2026-71212 in xidown
Summary
by MITRE • 08/05/2026
xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner.py and downloader.py) by appending the user-provided or scanned URL as a bare trailing positional argument, with no '--' end-of-options marker and no scheme validation anywhere in the codebase. Because yt-dlp parses any argument beginning with '-' as a CLI option rather than link text, a crafted 'URL' value such as -U (yt-dlp's self-update flag) or --exec=... is parsed as a real yt-dlp option instead of a URL, altering the tool's control flow before its own URL validation runs. Full code execution via --exec was not demonstrated in the single-URL flow tested, but the underlying argument-injection primitive is confirmed and unmitigated across all call sites.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/05/2026
This vulnerability represents a critical command injection flaw in xidown, a graphical user interface wrapper for yt-dlp and ffmpeg utilities. The core issue stems from improper argument handling where user-provided URLs are directly appended to yt-dlp command-line invocations without proper sanitization or delimiters. The absence of the '--' end-of-options marker means that any URL string beginning with a dash character is interpreted by yt-dlp as a command-line option rather than a literal URL. This fundamental design flaw creates an arbitrary code execution primitive that can be exploited through specially crafted input values.
The technical exploitation occurs because yt-dlp's argument parser treats any string starting with '-' as a potential CLI flag, making it impossible for the application to distinguish between legitimate command options and user-supplied URLs. When users provide URLs containing strings like -U for self-update or --exec= for executing shell commands, these values get processed as actual yt-dlp flags rather than URL parameters. This vulnerability falls under CWE-77 and CWE-88 categories, specifically addressing command injection vulnerabilities where untrusted data is incorporated into command-line arguments without proper validation or sanitization. The flaw exists across multiple code locations in the xidown/core/scanner.py and downloader.py modules, making it a widespread issue throughout the application's functionality.
The operational impact of this vulnerability extends beyond simple command execution to potentially allow full system compromise through arbitrary code injection. While the specific demonstration focused on a single URL flow where full code execution wasn't achieved, the underlying primitive remains unmitigated across all call sites within the application. Attackers can leverage this vulnerability to inject malicious yt-dlp options that could modify download behavior, execute arbitrary shell commands, or even trigger other unintended operations within the yt-dlp utility itself. The lack of scheme validation in the codebase compounds the risk by allowing any malformed URL to be processed without proper protocol checking, potentially enabling more sophisticated attack vectors.
Mitigation strategies should address both immediate and long-term security concerns for this vulnerability. Immediate fixes require implementing proper argument delimiters using the '--' marker before appending user-provided URLs to prevent option parsing conflicts. Additionally, input validation should be implemented to reject or sanitize any strings beginning with dash characters that could be interpreted as CLI options. The codebase should also incorporate proper URL scheme validation to ensure only legitimate protocols are accepted during processing. For defensive measures, implementing a whitelist approach for valid URL formats and employing parameterized command execution where possible would significantly reduce the attack surface. Organizations should consider applying patches or updates to xidown that address this fundamental argument handling flaw, as it represents a persistent security weakness that could be exploited by adversaries with minimal technical expertise to gain unauthorized access to systems running vulnerable versions of the application. This vulnerability aligns with ATT&CK technique T1059 for command and script injection, emphasizing the need for comprehensive input validation and secure coding practices throughout the software development lifecycle.