Vulnerability · Published Apr 13, 2026 · Assigned by VulDB

CVE-2026-6219aandrew-me ytDownloader Compressor Feature compressor.js child_process.exec command injection

Medium 5.3

In plain English

A medium-severity command injection in ytDownloader from aandrew-me. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)1.0%top 36.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in aandrew-me ytDownloader up to 3.20.2. This affects the function child_process.exec of the file src/compressor.js of the component Compressor Feature. This manipulation causes command injection. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

Affected products (as reported)

Vendor	Product	Versions
aandrew-me	ytDownloader	3.20.03.20.13.20.2

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-357140 | aandrew-me ytDownloader Compressor Feature compressor.js child_process.exec command injection vdb-entry, technical-description
VDB-357140 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #785843 | Aandrew-me ytDownloader 3.20.2 Command Injection third-party-advisory
Submit #785844 | Aandrew-me ytDownloader 3.20.2 Command Injection (Duplicate) third-party-advisory
https://gist.github.com/ngocnn97/53a9f251d1cb99b1b8033e211407d1b1 related
https://github.com/ngocnn97/security-advisories/blob/main/YtDownloader_Command_Injection_PoC.mp4 exploit