Description
A vulnerability was determined in aandrew-me ytDownloader up to 3.20.2. This affects the function child_process.exec of the file src/compressor.js of the component Compressor Feature. This manipulation causes command injection. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
CVSS breakdown
CVSS 4.0
Attack Vector
Local
Attack Complexity
Low
Attack Requirements
None
Privileges Required
Low
User Interaction
None
Confidentiality (Vulnerable System)
Low
Integrity (Vulnerable System)
Low
Availability (Vulnerable System)
Low
Confidentiality (Subsequent System)
None
Integrity (Subsequent System)
None
Availability (Subsequent System)
None
E
Physical
CVSS 3.1
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
E
Physical
RL
X
RC
Required
Affected products
- aandrew-me / ytDownloader3.20.0 – 3.20.0
- aandrew-me / ytDownloader3.20.1 – 3.20.1
- aandrew-me / ytDownloader3.20.2 – 3.20.2
References
- MISChttps://vuldb.com/vuln/357140
- MISChttps://vuldb.com/vuln/357140/cti
- MISChttps://vuldb.com/submit/785843
- MISChttps://vuldb.com/submit/785844
- MISChttps://gist.github.com/ngocnn97/53a9f251d1cb99b1b8033e211407d1b1
- VENDOR_ADVISORYhttps://github.com/ngocnn97/security-advisories/blob/main/YtDownloader_Command_Injection_PoC.mp4