Security Digest · Vulnerability record
CVE-2025-43858: YoutubeDLSharp allows command injection on windows system due to non sanitized arguments
YoutubeDLSharp is a wrapper for the command-line video downloaders youtube-dl and yt-dlp.
CVSS 9.2 Critical EPSS 0.3% · p17
Should you act?
Critical, preconditions apply
Severe if exploited, but exploitation needs conditions that may not apply to you. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.
- Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 0.3%, percentile 17: FIRST’s model estimates a 0.3% chance of exploitation activity in the next 30 days, higher than 17% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Needs local access needed. Lower urgency for most teams unless an attacker could already run code on the machine.
- Only applies if your dependency tree includes
YoutubeDLSharp(NuGet) >= 1.0.0-beta4, < 1.1.2, fixed in 1.1.2. Check your lockfile, including transitive dependencies.
What it is
YoutubeDLSharp is a wrapper for the command-line video downloaders youtube-dl and yt-dlp. In versions starting from 1.0.0-beta4 and prior to 1.1.2, an unsafe conversion of arguments allows the injection of a malicious commands when starting yt-dlp from a commands prompt running on Windows OS with the UseWindowsEncodingWorkaround value defined to true (default behavior). If a user is using built-in methods from the YoutubeDL.cs file, the value is true by default and a user cannot disable it from these methods. This issue has been patched in version 1.1.2.
From the GitHub advisory
Summary This vulnerability only apply when running on a Windows OS. An unsafe conversion of arguments allows the injection of a malicous commands when starting yt-dlp from a commands prompt.
> [!CAUTION] > NOTE THAT DEPENDING ON THE CONTEXT AND WHERE THE LIBRARY IS USED, THIS MAY HAVE MORE SEVERE CONSEQUENCES. FOR EXAMPLE, A USER USING THE LIBRARY LOCALLY IS A LOT LESS VULNERABLE THAN AN ASP.NET APPLICATION ACCEPTING INPUTS FROM A NETWORK/INTERNET.
Details
The vulnerability have been implemented in a commit (https://github.com/Bluegrams/YoutubeDLSharp/commit/fdf3256da18d0e2da4a2f33ad4a1b72ff8273a50) 3 year ago to fix a issue with unicode characters on Windows. ( In the latest version at the time of writing this, the code seems to have moved here : https://github.com/Bluegrams/YoutubeDLSharp/blob/b2f7968a2ef06a9c7b2c212785cfeac0b187b6d8/YoutubeDLSharp/YoutubeDLProcess.cs#L87 ) In this commit, a new way of starting yt-dlp was implemented, method that was defined as the default behaviour.
When the internal method ConvertToArgs get called, the application will test multiples conditions to decide on how the yt-dlp application should be started. The condition we are interesed in, as well a the default one on Windows, is at line 99 . Inside the if statement, we can see that insead of directly calling the yt-dlp binary, a command prompt is opened to run yt-dlp.
Weakness type: CWE-77, CWE-78.
Product: YoutubeDLSharp (NuGet) · Assigned by: GitHub_M · Published: 2025-04-24
Affected and fixed versions
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| NuGet | YoutubeDLSharp | >= 1.0.0-beta4, < 1.1.2 | 1.1.2 |
| Vendor | Product | Affected versions (per CVE record) |
|---|---|---|
| Bluegrams | YoutubeDLSharp | >= 1.0.0-beta4, < 1.1.2 |
Severity scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_M | 3.1 | 9.2 Critical | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L |
| GitHub | 3.1 | 9.2 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L |
- Attack vector: local access needed
- Attack complexity: low
- Privileges required: none (no login)
- User interaction: none
- Scope: changed (can affect other components)
CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.
Exploitation and urgency
- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc, automatable no, technical impact total.
- FIRST EPSS (model of 2026-10-21): 0.26% probability of exploitation activity in the next 30 days; percentile 17.
Timeline
- — GitHub-reviewed advisory GHSA-2jh5-g5ch-43q5 published (critical)
- — CVE record last updated
- — CVE record published by GitHub_M
Sources and references
Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.
Vulnerability records
- GitHub Advisory GHSA-2jh5-g5ch-43q5 github.com
- CVE.org record CVE-2025-43858 cve.org
- NVD entry CVE-2025-43858 nvd.nist.gov
Other references from the CVE record and advisory
- github.com github.com
- github.com github.com
- github.com github.com