CVE-2025-43858 Details
Description
YoutubeDLSharp is a wrapper for the command-line video downloaders youtube-dl and yt-dlp. In versions starting from 1.0.0-beta4 and prior to 1.1.2, an unsafe conversion of arguments allows the injection of a malicious commands when starting `yt-dlp` from a commands prompt running on Windows OS with the `UseWindowsEncodingWorkaround` value defined to true (default behavior). If a user is using built-in methods from the YoutubeDL.cs file, the value is true by default and a user cannot disable it from these methods. This issue has been patched in version 1.1.2.
A command injection vulnerability has been identified in YoutubeDLSharp, a .NET wrapper for the video downloaders youtube-dl and yt-dlp. This issue affects versions 1.0.0-beta4 prior to 1.1.2. The vulnerability arises from an unsafe handling of arguments when yt-dlp is launched from a command prompt on Windows. By default, the 'UseWindowsEncodingWorkaround' option is enabled, allowing the injection of malicious commands. Users utilizing built-in methods from the YoutubeDL.cs file cannot disable this option, leaving them vulnerable.
Upgrade to YoutubeDLSharp version 1.1.2 or higher, where the vulnerability has been patched by removing the 'UseWindowsEncodingWorkaround' option. If using version 1.1.1 or lower, and the latest version is not an option, manually sanitize inputs to remove any potentially malicious content before passing them to yt-dlp.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 24, 2025CISA-ADP
Assessed Apr 24, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Bluegrams/YoutubeDLSharp/security/advisories/GHSA-2jh5-g5ch-43q5 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Bluegrams/YoutubeDLSharp/commit/b6051372bd5af30f95f73de47d9bc71c3a07de0f | [email protected] | Source CodeVendor |
| https://github.com/Bluegrams/YoutubeDLSharp/commit/fdf3256da18d0e2da4a2f33ad4a1b72ff8273a50 | [email protected] | Source CodeVendor |
| https://github.com/Bluegrams/YoutubeDLSharp/security/advisories/GHSA-2jh5-g5ch-43q5 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Bluegrams YoutubeDLSharp | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2025 | CVE Modified | CISA-ADP |
| Apr 24, 2025 | New CVE Received | [email protected] |