Argument Injection Vulnerability in Xidown by XYZ Company

CVE-2026-71212

What is CVE-2026-71212?

The Xidown application, which serves as a GUI wrapper for yt-dlp and ffmpeg, suffers from a vulnerability due to improper handling of user-inputted URL strings. When constructing command-line invocations, the application appends user-defined or scanned URLs without validating their format or applying proper termination markers. This oversight allows users to inject commands that could change the execution flow of yt-dlp. Specifically, arguments that begin with a '-' character are misinterpreted as CLI options rather than URLs. Although full arbitrary code execution was not demonstrated, the potential for exploitation via crafted input remains a significant security concern.

References