PT-2025-41824 · Unknown+1 · Yt-Grabber-Tui+1

Zheny-Creator · Published 2025-10-13 · Updated 2025-10-14 · CVE-2025-62363

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions yt-grabber-tui versions prior to 1.0-rc

Description yt-grabber-tui is a terminal user interface application for downloading videos. Versions before 1.0-rc allow configuration of the path to the yt-dlp executable via the path to yt dlp configuration setting. An attacker with write access to the configuration file or the filesystem location of the configured executable can replace the executable with malicious code or create a symbolic link to an arbitrary executable. When the application invokes yt-dlp, the malicious code is executed with the privileges of the user running yt-grabber-tui.

Recommendations Update to version 1.0-rc or later.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2025-62363

GHSA-94C4-WH57-8P9C

Affected Products

Yt-Dlp

Yt-Grabber-Tui

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62363.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-62363 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62363 · Vendor Advisory
• https://github.com/zheny-creator/YtGrabber-TUI/security/advisories/GHSA-94c4-wh57-8p9c · Note
• https://github.com/zheny-creator/YtGrabber-TUI/commit/7adfdb68e8bf24559d1e9d8d4668de3d82c45591 · Note
• https://t.me/cveNotify/138472 · Telegram Post
• https://t.me/CVEtracker/34805 · Telegram Post
• https://twitter.com/CVEnew/status/1977854471725273556 · Twitter Post
• https://twitter.com/CveTodo/status/1977864036961165436 · Twitter Post