Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.2

Windows users of YoutubeDLSharp may have commands injected by attackers

CVE-2025-43858 · published 1 year ago
Summary

A security issue in YoutubeDLSharp's command-line interface on Windows allows attackers to execute malicious commands. This can happen when using certain methods in the library. Update to version 1.1.2 or later to fix the issue.

What to do
  • Update bluegrams youtubedlsharp to version 1.1.2.
Affected software
Ecosystem VendorProductAffected versions
nuget bluegrams youtubedlsharp >= 1.0.0-beta4, < 1.1.2
Fix: upgrade to 1.1.2
Original advisory text
YoutubeDLSharp allows command injection on windows system due to non sanitized arguments
YoutubeDLSharp is a wrapper for the command-line video downloaders youtube-dl and yt-dlp. In versions starting from 1.0.0-beta4 and prior to 1.1.2, an unsafe conversion of arguments allows the injection of a malicious commands when starting `yt-dlp` from a commands prompt running on Windows OS with the `UseWindowsEncodingWorkaround` value defined to true (default behavior). If a user is using built-in methods from the YoutubeDL.cs file, the value is true by default and a user cannot disable it from these methods. This issue has been patched in version 1.1.2.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.2 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-77Command Injection
CWE-78OS Command Injection
Timeline
Published24 Apr 2025
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-2jh5-g5ch-43q5 · GHSA
CVE-2025-43858 · NVD
CVE-2025-43858 · OSV
Track software like this
Free during beta