PT-2025-17849 · Unknown+1 · Youtubedlsharp+1

Kitsumed · Published 2025-04-23 · Updated 2025-04-25 · CVE-2025-43858

Positive Technologies (AI Summary)

CVSS v3.1

9.2

Critical

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions YoutubeDLSharp versions 1.0.0-beta4 through 1.1.2

Description The issue is related to an unsafe conversion of arguments, allowing the injection of malicious commands when starting yt-dlp from a command prompt on Windows OS with the UseWindowsEncodingWorkaround value defined as true. This is the default behavior, especially when using built-in methods from the YoutubeDL.cs file, where the value cannot be disabled. The problem has been patched in version 1.1.2.

Recommendations For versions 1.0.0-beta4 through 1.1.2, update to version 1.1.2 to resolve the issue. As a temporary workaround, consider disabling the UseWindowsEncodingWorkaround value, if possible, until a patch is applied. Restrict access to the yt-dlp command prompt on Windows OS to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2025-43858

GHSA-2JH5-G5CH-43Q5

Affected Products

Youtubedlsharp

Yt-Dlp

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/43xxx/CVE-2025-43858.json · Exploit
• 🔥 https://github.com/Bluegrams/YoutubeDLSharp/security/advisories/GHSA-2jh5-g5ch-43q5 · Exploit
• https://osv.dev/vulnerability/GHSA-2jh5-g5ch-43q5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-43858 · Security Note
• https://osv.dev/vulnerability/CVE-2025-43858 · Vendor Advisory
• https://github.com/Bluegrams/YoutubeDLSharp/commit/b6051372bd5af30f95f73de47d9bc71c3a07de0f · Note
• https://github.com/Bluegrams/YoutubeDLSharp/commit/fdf3256da18d0e2da4a2f33ad4a1b72ff8273a50 · Note
• https://github.com/Bluegrams/YoutubeDLSharp · Note
• https://twitter.com/CveFindCom/status/1915474070025425112 · Twitter Post
• https://twitter.com/CVEnew/status/1915477793653051487 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1915568515207057894 · Twitter Post
• https://twitter.com/cybercronai/status/1915742711811866784 · Twitter Post
• https://twitter.com/cybercronai/status/1915847143404749136 · Twitter Post
• https://t.me/cvedetector/23696 · Telegram Post
• https://t.me/cvetracker/22317 · Telegram Post