« Volver al listado

CVE-2025-43858

Estado: AplazadaCrítica (9.2)—

YoutubeDLSharp is a wrapper for the command-line video downloaders youtube-dl and yt-dlp. In versions starting from 1.0.0-beta4 and prior to 1.1.2, an unsafe conversion of arguments allows the injection of a malicious commands when starting `yt-dlp` from a commands prompt running on Windows OS with the `UseWindowsEncodingWorkaround` value defined to true (default behavior). If a user is using built-in methods from the YoutubeDL.cs file, the value is true by default and a user cannot disable it from these methods. This issue has been patched in version 1.1.2.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso local sin interacción (AV:L/PR:N/UI:N) con inyección de comandos en Windows mediante argumento inseguro. CWE-78 (OS Command Injection) permite ejecución de comandos arbitrarios con privilegios elevados (S:C/I:H).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution PreventionThreat Intelligence ProgramRestrict Web-Based ContentPrivileged Account ManagementLimit Software InstallationBehavior Prevention on Endpoint

Tecnologías afectadas (3)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Youtube — Youtube-dlAIYoutubedlsharp — YoutubedlsharpAIYtdlp — Yt-dlpAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-43858",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-43858",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-24T19:03:58.754946Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.2,
          "attackVector": "LOCAL",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.5
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "Bluegrams",
          "product": "YoutubeDLSharp",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.0.0-beta4, < 1.1.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-04-24T18:15:20.120",
  "references": [
    {
      "url": "https://github.com/Bluegrams/YoutubeDLSharp/commit/b6051372bd5af30f95f73de47d9bc71c3a07de0f",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Bluegrams/YoutubeDLSharp/commit/fdf3256da18d0e2da4a2f33ad4a1b72ff8273a50",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Bluegrams/YoutubeDLSharp/security/advisories/GHSA-2jh5-g5ch-43q5",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Bluegrams/YoutubeDLSharp/security/advisories/GHSA-2jh5-g5ch-43q5",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        },
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "YoutubeDLSharp is a wrapper for the command-line video downloaders youtube-dl and yt-dlp. In versions starting from 1.0.0-beta4 and prior to 1.1.2, an unsafe conversion of arguments allows the injection of a malicious commands when starting `yt-dlp` from a commands prompt running on Windows OS with the `UseWindowsEncodingWorkaround` value defined to true (default behavior). If a user is using built-in methods from the YoutubeDL.cs file, the value is true by default and a user cannot disable it from these methods. This issue has been patched in version 1.1.2."
    },
    {
      "lang": "es",
      "value": "YoutubeDLSharp es un contenedor para los descargadores de vídeo de línea de comandos youtube-dl y yt-dlp. En versiones a partir de la 1.0.0-beta4 y anteriores a la 1.1.2, una conversión insegura de argumentos permite la inyección de comandos maliciosos al iniciar `yt-dlp` desde un símbolo del sistema en Windows con el valor `UseWindowsEncodingWorkaround` definido como verdadero (comportamiento predeterminado). Si un usuario utiliza métodos integrados del archivo YoutubeDL.cs, el valor es verdadero por defecto y no se puede desactivar desde estos métodos. Este problema se ha corregido en la versión 1.1.2."
    }
  ],
  "lastModified": "2026-06-17T09:24:39.480",
  "sourceIdentifier": "security-advisories@github.com"
}