CVE-2026-71212

Name of the Vulnerable Software and Affected Versions xidown (affected versions not specified)

Description The software improperly constructs command-line invocations for yt-dlp within xidown/core/scanner.py and downloader.py by appending user-provided or scanned URLs as bare trailing positional arguments. The application lacks scheme validation and does not use an end-of-options marker. Consequently, if a URL begins with a hyphen, yt-dlp interprets it as a command-line option rather than a link. This argument-injection flaw allows an attacker to alter the tool's control flow using flags such as -U or --exec=... before the internal URL validation occurs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.