CyberRota Analysis
AI-GeneratedThe vulnerability affects xidown, a GUI wrapper for yt-dlp/ffmpeg, which improperly handles user-provided URLs by appending them as trailing arguments without adequate validation. This flaw allows crafted inputs to be interpreted as command-line options, potentially altering the tool's execution flow and leading to unintended behavior. Developers and security teams using xidown should prioritize addressing this issue to mitigate risks associated with command injection and ensure safe usage of the tool.
Original NVD Description
xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner.py and downloader.py) by appending the user-provided or scanned URL as a bare trailing positional argument, with no '--' end-of-options marker and no scheme validation anywhere in the codebase.