Command Injection Vulnerability in YoutubeDLSharp by Bluegrams
CVE-2025-43858
9.2CRITICAL
What is CVE-2025-43858?
YoutubeDLSharp, a library integrating with popular video downloaders youtube-dl and yt-dlp, is susceptible to command injection. Versions from 1.0.0-beta4 to prior 1.1.2 have an unsafe argument conversion that can allow an attacker to execute malicious commands via the Windows command prompt. This vulnerability arises when the 'UseWindowsEncodingWorkaround' setting, which is enabled by default, is utilized in built-in methods of the YoutubeDL.cs file, preventing users from disabling this behavior. Users are advised to upgrade to version 1.1.2 or later where this vulnerability has been addressed.
Affected Version(s)
YoutubeDLSharp >= 1.0.0-beta4, < 1.1.2