PT-2025-42651 · Unknown · Yt-Grabber-Tui

Published 2025-10-17 · Updated 2025-10-17 · CVE-2025-62511

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions yt-grabber-tui version 1.0

Description yt-grabber-tui is a C++ terminal user interface application for downloading YouTube content. A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the creation of the default configuration file config.json. Specifically, the load json settings function in Settings.hpp checks for the existence of config.json and, if missing, calls create json settings to write a new JSON configuration file. A local attacker with write access to the application’s configuration directory can create a symbolic link to overwrite an attacker-chosen file accessible to the running process. This enables arbitrary file overwrite, potentially leading to data corruption or loss. If the application is run with elevated privileges, system file corruption is possible.

Recommendations Update to version 1.0.1 or later.

Exploit

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2025-62511

GHSA-HWWF-FQ6P-RW9Q

Affected Products

Yt-Grabber-Tui

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62511.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-62511 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62511 · Vendor Advisory
• https://github.com/zheny-creator/YtGrabber-TUI/security/advisories/GHSA-hwwf-fq6p-rw9q · Note
• https://github.com/zheny-creator/YtGrabber-TUI/commit/bf065e833820bb4253a70a4c1dc6b843c6d8bf21 · Note
• https://t.me/cveNotify/139264 · Telegram Post
• https://t.me/CVEtracker/35220 · Telegram Post
• https://twitter.com/CVEnew/status/1979289015078490164 · Twitter Post