CVE-2025-62363: yt-grabber-tui Privilege Escalation Flaw

CVE-2025-62363 Overview

CVE-2025-62363 affects yt-grabber-tui, a terminal user interface application for downloading videos. Versions before 1.0-rc allow users to configure the path to the yt-dlp executable through the path_to_yt_dlp configuration setting. An attacker with write access to the configuration file or the filesystem location of the configured executable can replace the binary or create a symlink pointing to arbitrary code. When yt-grabber-tui invokes yt-dlp, the substituted code executes with the privileges of the user running the application. The maintainer patched the flaw in version 1.0-rc.

Critical Impact
Local attackers can achieve arbitrary code execution as the yt-grabber-tui user through symlink substitution [CWE-59] of the configured yt-dlp binary.

Affected Products

yt-grabber-tui versions prior to 1.0-rc
Installations exposing writable configuration files to untrusted users
Systems where the configured yt-dlp executable path is writable by non-owner accounts

Discovery Timeline

2025-10-13 - CVE-2025-62363 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62363

Vulnerability Analysis

yt-grabber-tui reads the path_to_yt_dlp value from its configuration file and executes the referenced binary to perform video downloads. The application does not validate that the target is a regular file, does not verify ownership, and does not resolve symbolic links before execution. This exposes a classic link-following weakness [CWE-59] where a filesystem primitive is trusted without integrity checks.

Execution occurs in the context of the invoking user. On multi-user systems or shared build agents, any process able to modify the configuration file or the executable path can execute arbitrary code the next time yt-grabber-tui runs.

Root Cause

The root cause is unchecked trust in a user-controllable filesystem path. The application invokes the executable at path_to_yt_dlp without confirming the target is the legitimate yt-dlp binary. An attacker replaces the file, or points a symbolic link at /bin/sh or a malicious payload, and gains code execution when yt-grabber-tui launches the process.

Attack Vector

Exploitation requires local access with write permissions on either the configuration file or the resolved binary path. The attacker modifies path_to_yt_dlp, plants a malicious executable, or creates a symlink to arbitrary code. When the victim launches yt-grabber-tui and triggers a download, the substituted binary runs with the victim's privileges.

cpp

// Patch excerpt from src/main.cpp - input validation added
{
    cout << "Введите ссылку на видео: ";
    getline(cin, url); // url
+   if (url.empty())
+   {
+       cerr << "Ссылка на видео не введена!" << endl;
+       continue; // if url empty
+   }
    auto q = config.get_child("quality");
    string enabled = q.get<string>("enabled", "false");
    int quality_video = q.get<int>("quality", 1080);
}
// Source: https://github.com/zheny-creator/YtGrabber-TUI/commit/7adfdb68e8bf24559d1e9d8d4668de3d82c45591

text

// Patch excerpt from include/yt-dlp.hpp - directory path rejected before execution
else if (fs::is_directory(config.get<string>("Custom Path to ffmpeg.path", "ffmpeg")))
{
    cerr << "Это путь к папке!" << endl;
+   return;
}
else if (fs::exists(config.get<string>("Custom Path to ffmpeg.path", "ffmpeg")))
// Source: https://github.com/zheny-creator/YtGrabber-TUI/commit/7adfdb68e8bf24559d1e9d8d4668de3d82c45591

Detection Methods for CVE-2025-62363

Indicators of Compromise

Symbolic links at the path referenced by path_to_yt_dlp pointing to unexpected targets such as /bin/sh, /tmp/, or user-writable directories.
Recent modifications to yt-grabber-tui configuration files by accounts other than the application owner.
Unexpected child processes spawned by yt-grabber-tui that do not match the legitimate yt-dlp binary hash.

Detection Strategies

Baseline the SHA-256 hash of the legitimate yt-dlp binary and alert on divergence at the configured path.
Monitor execve telemetry for yt-grabber-tui parent processes launching shells or interpreters instead of yt-dlp.
Audit filesystem events (inotify, auditd path= rules) on the yt-grabber-tui configuration file and executable location.

Monitoring Recommendations

Enable Linux auditd rules on the configuration directory and the resolved path_to_yt_dlp target to capture writes and symlink creations.
Correlate process creation events where the parent is yt-grabber-tui and the child image path differs from the approved yt-dlp install location.
Track configuration file integrity using file integrity monitoring across shared or multi-user hosts.

How to Mitigate CVE-2025-62363

Immediate Actions Required

Upgrade yt-grabber-tui to version 1.0-rc or later, which contains the fix in commit 7adfdb6.
Restrict write permissions on the yt-grabber-tui configuration file to the owning user only (mode 0600).
Verify the path_to_yt_dlp value points to a trusted, non-symlinked binary owned by root or the application owner.

Patch Information

The maintainer released the fix in version 1.0-rc. See the GitHub Security Advisory GHSA-94c4-wh57-8p9c and the corresponding remediation commit for the code changes.

Workarounds

Set the configuration file and its parent directory to be writable only by the application user, blocking tampering by other local accounts.
Store yt-dlp in a system location such as /usr/local/bin/ owned by root with mode 0755 and reference that absolute path.
Remove or replace any existing symbolic links at the configured executable path with the legitimate yt-dlp binary before running the application.

bash

# Configuration example - lock down configuration and executable
chmod 600 ~/.config/yt-grabber-tui/config.ini
chown "$USER":"$USER" ~/.config/yt-grabber-tui/config.ini

# Ensure the configured yt-dlp is a real file owned by root
sudo install -o root -g root -m 0755 /path/to/yt-dlp /usr/local/bin/yt-dlp
test -L /usr/local/bin/yt-dlp && echo "WARNING: symlink present" || echo "OK: regular file"