Muhammadsiddiq

**Name of the Vulnerable Software and Affected Versions** xidown (affected versions not specified) **Description** The software improperly constructs command-line invocations for yt-dlp within `xidown/core/scanner.py` and `downloader.py` by appending user-provided or scanned URLs as bare trailing positional arguments. The application lacks scheme validation and does not use an end-of-options marker. Consequently, if a URL begins with a hyphen, yt-dlp interprets it as a command-line option rather than a link. This argument-injection flaw allows an attacker to alter the tool's control flow using flags such as `-U` or `--exec=...` before the internal URL validation occurs. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** art-template (affected versions not specified) **Description** Sub-template resolution logic in `src/compile/adapter/resolve-filename.js`, utilized by the `include()` and `extend()` template directives, fails to verify if the resolved file path remains within the intended root directory. The process uses `path.resolve(root, filename)`, which allows absolute paths to override the root and permits the use of `../` traversal sequences. Since the resulting path is passed to `fs.readFileSync()` in `loader.js` for compilation and rendering, an attacker can read arbitrary files accessible to the Node process if the sub-template name is influenced by external input, such as a query parameter passed into `{{include page}}`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.