Vulnerability · Published Apr 24, 2025 · Assigned by GitHub_M
CVE-2025-43858YoutubeDLSharp allows command injection on windows system due to non sanitized arguments
Critical 9.2
In plain English
A critical-severity command injection in YoutubeDLSharp from Bluegrams. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
YoutubeDLSharp is a wrapper for the command-line video downloaders youtube-dl and yt-dlp. In versions starting from 1.0.0-beta4 and prior to 1.1.2, an unsafe conversion of arguments allows the injection of a malicious commands when starting `yt-dlp` from a commands prompt running on Windows OS with the `UseWindowsEncodingWorkaround` value defined to true (default behavior). If a user is using built-in methods from the YoutubeDL.cs file, the value is true by default and a user cannot disable it from these methods. This issue has been patched in version 1.1.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | youtubedlsharp | 1.1.2 | GHSA-2jh5-g5ch-43q5 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bluegrams | YoutubeDLSharp | >= 1.0.0-beta4, < 1.1.2 |
Weakness: CWE-77, CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
References
- https://github.com/Bluegrams/YoutubeDLSharp/security/advisories/GHSA-2jh5-g5ch-43q5 x_refsource_CONFIRM
- https://github.com/Bluegrams/YoutubeDLSharp/commit/b6051372bd5af30f95f73de47d9bc71c3a07de0f x_refsource_MISC
- https://github.com/Bluegrams/YoutubeDLSharp/commit/fdf3256da18d0e2da4a2f33ad4a1b72ff8273a50 x_refsource_MISC