https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 10:13:48 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-349624 EUVD-2026-349624 https://cve.radiocsirt.org/vuln/euvd-2026-349624 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71212 <p>xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner.py and downloader.py) by appending the user-provided or scanned URL as a bare trailing positional argument, with no &#39;--&#39; end-of-options marker and no scheme validation anywhere in the codebase.</p> <p>xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner.py and downloader.py) by appending the user-provided or scanned URL as a bare trailing positional argument, with no &#39;--&#39; end-of-options marker and no scheme validation anywhere in the codebase.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-71212 https://cve.radiocsirt.org/vuln/ghsa-f3j9-9qqv-p4r8 <p>xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner.py and downloader.py) by appending the user-provided or scanned URL as a bare trailing positional argument, with no &#39;--&#39; end-of-options marker and no scheme validation anywhere in the codebase. Because yt-dlp parses any argument beginning with &#39;-&#39; as a CLI option rather than link text, a crafted &#39;URL&#39; value such as -U (yt-dlp&#39;s self-update flag) or --exec=... is parsed as a real yt-dlp option instead of a URL, altering the tool&#39;s control flow before its own URL validation runs. Full code execution via --exec was not demonstrated in the single-URL flow tested, but the underlying argument-injection primitive is confirmed and unmitigated across all call sites.</p> <p>xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner.py and downloader.py) by appending the user-provided or scanned URL as a bare trailing positional argument, with no &#39;--&#39; end-of-options marker and no scheme validation anywhere in the codebase. Because yt-dlp parses any argument beginning with &#39;-&#39; as a CLI option rather than link text, a crafted &#39;URL&#39; value such as -U (yt-dlp&#39;s self-update flag) or --exec=... is parsed as a real yt-dlp option instead of a URL, altering the tool&#39;s control flow before its own URL validation runs. Full code execution via --exec was not demonstrated in the single-URL flow tested, but the underlying argument-injection primitive is confirmed and unmitigated across all call sites.</p> https://cve.radiocsirt.org/vuln/ghsa-f3j9-9qqv-p4r8 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-71212 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: libav, Ubuntu:Pro:16.04:LTS: ffmpeg, Ubuntu:16.04:LTS: its, Ubuntu:Pro:18.04:LTS: ffmpeg, Ubuntu:18.04:LTS: its, Ubuntu:Pro:20.04:LTS: ffmpeg, Ubuntu:20.04:LTS: its, Ubuntu:22.04:LTS: yt-dlp, Ubuntu:Pro:22.04:LTS: ffmpeg, Ubuntu:24.04:LTS: yt-dlp and 3 more</p> <p>xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner.py and downloader.py) by appending the user-provided or scanned URL as a bare trailing positional argument, with no &#39;--&#39; end-of-options marker and no scheme validation anywhere in the codebase.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: libav, Ubuntu:Pro:16.04:LTS: ffmpeg, Ubuntu:16.04:LTS: its, Ubuntu:Pro:18.04:LTS: ffmpeg, Ubuntu:18.04:LTS: its, Ubuntu:Pro:20.04:LTS: ffmpeg, Ubuntu:20.04:LTS: its, Ubuntu:22.04:LTS: yt-dlp, Ubuntu:Pro:22.04:LTS: ffmpeg, Ubuntu:24.04:LTS: yt-dlp and 3 more</p> <p>xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner.py and downloader.py) by appending the user-provided or scanned URL as a bare trailing positional argument, with no &#39;--&#39; end-of-options marker and no scheme validation anywhere in the codebase.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-71212