{"id":"CVE-2026-71212","aliases":["EUVD-2026-53209","GHSA-f3j9-9qqv-p4r8","UBUNTU-CVE-2026-71212"],"status":"published","title":"xidown - Argument Injection via Unterminated yt-dlp Command Line Construction","description":"xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner.py and downloader.py) by appending the user-provided or scanned URL as a bare trailing positional argument, with no '--' end-of-options marker and no scheme validation anywhere in the codebase.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00159,"percentile":0.05074,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-88"],"published":"2026-08-05T06:59:26Z","modified":"2026-10-24T15:10:00Z","affected":[{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6:0.8.7-1ubuntu2","6:9.10-1ubuntu1","6:9.10-1ubuntu2","6:9.10-1ubuntu5","6:9.10-1ubuntu6","6:9.10-1ubuntu7","6:9.11-2ubuntu1","6:9.11-2ubuntu2","6:9.13-0ubuntu0.14.04.1","6:9.14-0ubuntu0.14.04.1","6:9.16-0ubuntu0.14.04.1","6:9.18-0ubuntu0.14.04.1","6:9.20-0ubuntu0.14.04.1","6:9.20-0ubuntu0.14.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:2.7.2-1build1","7:2.8.1-1ubuntu1","7:2.8.2-1ubuntu1","7:2.8.3-1","7:2.8.4-1","7:2.8.4-1ubuntu1","7:2.8.4-1ubuntu2","7:2.8.4-1ubuntu3","7:2.8.4-1ubuntu4","7:2.8.6-1ubuntu1","7:2.8.6-1ubuntu2","7:2.8.8-0ubuntu0.16.04.1","7:2.8.10-0ubuntu0.16.04.1","7:2.8.11-0ubuntu0.16.04.1","7:2.8.14-0ubuntu0.16.04.1","7:2.8.15-0ubuntu0.16.04.1","7:2.8.15-0ubuntu0.16.04.1+esm1","7:2.8.17-0ubuntu0.1","7:2.8.17-0ubuntu0.1+esm1","7:2.8.17-0ubuntu0.1+esm2","7:2.8.17-0ubuntu0.1+esm3","7:2.8.17-0ubuntu0.1+esm4","7:2.8.17-0ubuntu0.1+esm5","7:2.8.17-0ubuntu0.1+esm6","7:2.8.17-0ubuntu0.1+esm7","7:2.8.17-0ubuntu0.1+esm8","7:2.8.17-0ubuntu0.1+esm9","7:2.8.17-0ubuntu0.1+esm10","7:2.8.17-0ubuntu0.1+esm11","7:2.8.17-0ubuntu0.1+esm12","7:2.8.17-0ubuntu0.1+esm13","7:2.8.17-0ubuntu0.1+esm14","7:2.8.17-0ubuntu0.1+esm15","7:2.8.17-0ubuntu0.1+esm16","7:2.8.17-0ubuntu0.1+esm17","7:2.8.17-0ubuntu0.1+esm18"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"its","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.8-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:3.3.4-2","7:3.3.4-2build3","7:3.4-2ubuntu2","7:3.4-4","7:3.4-4build1","7:3.4.1-1","7:3.4.1-1build1","7:3.4.2-1","7:3.4.2-1build1","7:3.4.2-2","7:3.4.4-0ubuntu0.18.04.1","7:3.4.6-0ubuntu0.18.04.1","7:3.4.8-0ubuntu0.2","7:3.4.11-0ubuntu0.1","7:3.4.11-0ubuntu0.1+esm1","7:3.4.11-0ubuntu0.1+esm2","7:3.4.11-0ubuntu0.1+esm3","7:3.4.11-0ubuntu0.1+esm4","7:3.4.11-0ubuntu0.1+esm5","7:3.4.11-0ubuntu0.1+esm6","7:3.4.11-0ubuntu0.1+esm7","7:3.4.11-0ubuntu0.1+esm8","7:3.4.11-0ubuntu0.1+esm9","7:3.4.11-0ubuntu0.1+esm10","7:3.4.11-0ubuntu0.1+esm11","7:3.4.11-0ubuntu0.1+esm12","7:3.4.11-0ubuntu0.1+esm13","7:3.4.11-0ubuntu0.1+esm14","7:3.4.11-0ubuntu0.1+esm15","7:3.4.11-0ubuntu0.1+esm16"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"its","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.8-6build1","1.1.8-6.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:4.1.4-1build2","7:4.2.1-2","7:4.2.1-2ubuntu1","7:4.2.2-1build1","7:4.2.2-1ubuntu1","7:4.2.4-1ubuntu0.1","7:4.2.4-1ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1","7:4.2.7-0ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1+esm2","7:4.2.7-0ubuntu0.1+esm3","7:4.2.7-0ubuntu0.1+esm4","7:4.2.7-0ubuntu0.1+esm5","7:4.2.7-0ubuntu0.1+esm6","7:4.2.7-0ubuntu0.1+esm7","7:4.2.7-0ubuntu0.1+esm8","7:4.2.7-0ubuntu0.1+esm9","7:4.2.7-0ubuntu0.1+esm10","7:4.2.7-0ubuntu0.1+esm11","7:4.2.7-0ubuntu0.1+esm12","7:4.2.7-0ubuntu0.1+esm13","7:4.2.7-0ubuntu0.1+esm14","7:4.2.7-0ubuntu0.1+esm15","7:4.2.7-0ubuntu0.1+esm16","7:4.2.7-0ubuntu0.1+esm17","7:4.2.7-0ubuntu0.1+esm18"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"its","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.8-7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"yt-dlp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2021.12.01-1","2021.12.27-1","2022.01.21-1","2022.02.04-1","2022.03.08.1-1","2022.04.08-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:4.4-6ubuntu5","7:4.4.1-2ubuntu1","7:4.4.1-3ubuntu1","7:4.4.1-3ubuntu2","7:4.4.1-3ubuntu3","7:4.4.1-3ubuntu5","7:4.4.2-0ubuntu0.22.04.1","7:4.4.2-0ubuntu0.22.04.1+esm1","7:4.4.2-0ubuntu0.22.04.1+esm2","7:4.4.2-0ubuntu0.22.04.1+esm3","7:4.4.2-0ubuntu0.22.04.1+esm4","7:4.4.2-0ubuntu0.22.04.1+esm5","7:4.4.2-0ubuntu0.22.04.1+esm6","7:4.4.2-0ubuntu0.22.04.1+esm7","7:4.4.2-0ubuntu0.22.04.1+esm8","7:4.4.2-0ubuntu0.22.04.1+esm9","7:4.4.2-0ubuntu0.22.04.1+esm10","7:4.4.2-0ubuntu0.22.04.1+esm11","7:4.4.2-0ubuntu0.22.04.1+esm12","7:4.4.2-0ubuntu0.22.04.1+esm13","7:4.4.2-0ubuntu0.22.04.1+esm14","7:4.4.2-0ubuntu0.22.04.1+esm15","7:4.4.2-0ubuntu0.22.04.1+esm16","7:4.4.2-0ubuntu0.22.04.1+esm17"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"yt-dlp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2023.07.06-1","2023.10.13-1ubuntu1","2023.11.16-1","2023.12.30-1ubuntu1","2024.03.10-1","2024.04.09-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:6.0-6ubuntu1","7:6.0-9ubuntu1","7:6.1-2ubuntu1","7:6.1-3ubuntu1","7:6.1-4ubuntu1","7:6.1-5ubuntu1","7:6.1.1-1ubuntu1","7:6.1.1-3ubuntu1","7:6.1.1-3ubuntu5","7:6.1.1-3ubuntu5+esm1","7:6.1.1-3ubuntu5+esm2","7:6.1.1-3ubuntu5+esm3","7:6.1.1-3ubuntu5+esm4","7:6.1.1-3ubuntu5+esm5","7:6.1.1-3ubuntu5+esm6","7:6.1.1-3ubuntu5+esm7","7:6.1.1-3ubuntu5+esm8","7:6.1.1-3ubuntu5+esm10","7:6.1.1-3ubuntu5+esm11","7:6.1.1-3ubuntu5+esm12","7:6.1.1-3ubuntu5+esm13","7:6.1.1-3ubuntu5+esm15"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:8.0.1-3ubuntu2","7:8.1-3ubuntu3","7:8.1.2-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"yt-dlp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2026.03.17-1","2026.06.09-1","2026.07.04-1","2026.08.19-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"yt-dlp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.09.23-1","2025.10.22-1","2025.11.12-1","2025.12.08-1","2026.01.31-1","2026.03.17-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:7.1.1-1ubuntu4","7:7.1.2-1ubuntu3","7:7.1.2-1ubuntu4","7:7.1.3-1ubuntu1","7:8.0.1-2ubuntu1","7:8.0.1-3ubuntu1","7:8.0.1-3ubuntu2","7:8.0.1-3ubuntu2+esm1","7:8.0.1-3ubuntu2+esm3","7:8.0.1-3ubuntu2+esm4","7:8.0.1-3ubuntu2+esm5"]}],"products":[{"vendor":"indravoyager","product":"xidown"}],"references":[{"url":"https://cwe.mitre.org/data/definitions/88.html","tags":["third-party-advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71212"},{"url":"https://github.com/advisories/GHSA-f3j9-9qqv-p4r8"},{"url":"https://ubuntu.com/security/CVE-2026-71212","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71212","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-71212","title":"xidown - Argument Injection via Unterminated yt-dlp Command Line Construction","description":"xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner.py and downloader.py) by appending the user-provided or scanned URL as a bare trailing positional argument, with no '--' end-of-options marker and no scheme validation anywhere in the codebase.","status":"published","published":"2026-08-05T06:59:26.576Z","modified":"2026-08-10T11:45:19.593Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T14:19:49.559463Z"}],"euvd":[{"id":"EUVD-2026-53209","description":"xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner.py and downloader.py) by appending the user-provided or scanned URL as a bare trailing positional argument, with no '--' end-of-options marker and no scheme validation anywhere in the codebase.","status":"published","published":"2026-08-05T06:59:26Z","modified":"2026-08-10T11:45:19Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T18:02:06.086083Z"}],"ghsa":[{"id":"GHSA-f3j9-9qqv-p4r8","title":"xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core...","description":"xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner.py and downloader.py) by appending the user-provided or scanned URL as a bare trailing positional argument, with no '--' end-of-options marker and no scheme validation anywhere in the codebase. Because yt-dlp parses any argument beginning with '-' as a CLI option rather than link text, a crafted 'URL' value such as -U (yt-dlp's self-update flag) or --exec=... is parsed as a real yt-dlp option instead of a URL, altering the tool's control flow before its own URL validation runs. Full code execution via --exec was not demonstrated in the single-URL flow tested, but the underlying argument-injection primitive is confirmed and unmitigated across all call sites.","status":"published","published":"2026-08-05T09:31:18Z","modified":"2026-08-05T09:31:18Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T15:10:06.083807Z"}],"nvd":[{"id":"CVE-2026-71212","description":"xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner.py and downloader.py) by appending the user-provided or scanned URL as a bare trailing positional argument, with no '--' end-of-options marker and no scheme validation anywhere in the codebase.","status":"published","published":"2026-08-05T08:16:43.503Z","modified":"2026-10-24T15:10:00.19Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T14:12:35.031043Z"}],"osv":[{"id":"UBUNTU-CVE-2026-71212","description":"xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner.py and downloader.py) by appending the user-provided or scanned URL as a bare trailing positional argument, with no '--' end-of-options marker and no scheme validation anywhere in the codebase.","status":"published","published":"2026-08-05T08:16:00Z","modified":"2026-10-17T13:00:43.716180058Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:57:03.035847Z"}]}}