https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T17:55:09.261337+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-235054 EUVD-2026-235054 2026-10-15T17:55:09.304292+00:00 EUVD-2026-235054 https://cve.radiocsirt.org/vuln/fkie_cve-2025-43858 fkie_cve-2025-43858 2026-10-15T17:55:09.304338+00:00

YoutubeDLSharp is a wrapper for the command-line video downloaders youtube-dl and yt-dlp. In versions starting from 1.0.0-beta4 and prior to 1.1.2, an unsafe conversion of arguments allows the injection of a malicious commands when starting `yt-dlp` from a commands prompt running on Windows OS with the `UseWindowsEncodingWorkaround` value defined to true (default behavior). If a user is using built-in methods from the YoutubeDL.cs file, the value is true by default and a user cannot disable it from these methods. This issue has been patched in version 1.1.2.

 https://cve.radiocsirt.org/vuln/ghsa-2jh5-g5ch-43q5 GHSA-2jh5-g5ch-43q5 — YoutubeDLSharp allows command injection on windows system due to non sanitized arguments 2026-10-15T17:55:09.304432+00:00

Affected: NuGet: YoutubeDLSharp

## Summary This vulnerability only apply when running on a Windows OS. An unsafe conversion of arguments allows the injection of a malicous commands when starting `yt-dlp` from a commands prompt.

> [!CAUTION] > **NOTE THAT DEPENDING ON THE CONTEXT AND WHERE THE LIBRARY IS USED, THIS MAY HAVE MORE SEVERE CONSEQUENCES. FOR EXAMPLE, A USER USING THE LIBRARY LOCALLY IS A LOT LESS VULNERABLE THAN AN ASP.NET APPLICATION ACCEPTING INPUTS FROM A NETWORK/INTERNET.**

## Details

The vulnerability have been implemented in a commit (https://github.com/Bluegrams/YoutubeDLSharp/commit/fdf3256da18d0e2da4a2f33ad4a1b72ff8273a50) 3 year ago to fix a issue with unicode characters on Windows. ( In the latest version at the time of writing this, the code seems to have moved here : https://github.com/Bluegrams/YoutubeDLSharp/blob/b2f7968a2ef06a9c7b2c212785cfeac0b187b6d8/YoutubeDLSharp/YoutubeDLProcess.cs#L87 ) In this commit, a new way of starting yt-dlp was implemented, method that was defined as the default behaviour.

When the internal method [`ConvertToArgs`](https://github.com/Bluegrams/YoutubeDLSharp/commit/fdf3256da18d0e2da4a2f33ad4a1b72ff8273a50#diff-8ec44b4ade6ce6ed38ebf7e765dc86c426984a18304cd1cd320bf92500133c88R64) get called, the application will test multiples conditions to decide on how the yt-dlp application should be started. The condition we are interesed in, as well a the default one on Windows, is at [line 99](https://github.com/Bluegrams/YoutubeDLSharp/commit/fdf3256da18d…