CVE-2026-71212 Overview
CVE-2026-71212 is an argument injection vulnerability [CWE-88] in xidown, a graphical user interface wrapper around yt-dlp and ffmpeg. The application builds its yt-dlp command line by appending user-supplied or scanned URLs as bare trailing positional arguments. The code omits the -- end-of-options separator and performs no URL scheme validation across the codebase. A crafted input beginning with -, such as -U or --exec=..., is interpreted by yt-dlp as a command-line option rather than a URL.
Critical Impact
Attackers who supply a crafted URL value can alter yt-dlp control flow before xidown's own URL validation executes, enabling option injection across all call sites.
Affected Products
- xidown (yt-dlp/ffmpeg GUI wrapper)
- xidown/core/scanner.py component
- xidown/core/downloader.py component
Discovery Timeline
- 2026-08-05 - CVE-2026-71212 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-71212
Vulnerability Analysis
The vulnerability resides in how xidown constructs subprocess invocations of yt-dlp. Both scanner.py and downloader.py append user-controlled URL strings directly to the end of the argument list. Neither call site inserts a -- sentinel to signal the end of options, and no code path validates that the input begins with a legitimate URL scheme such as http:// or https://.
yt-dlp follows standard POSIX-style argument parsing. Any token beginning with - is treated as an option flag rather than a positional URL argument. When xidown forwards a value like -U (the yt-dlp self-update flag) or --exec=<command>, yt-dlp parses it as a real CLI option before xidown's downstream URL validation runs.
Full code execution through --exec was not demonstrated in the single-URL flow tested. The underlying argument-injection primitive is confirmed and remains unmitigated across all call sites, leaving the attack surface open for further exploitation research.
Root Cause
The root cause is missing input sanitization and missing use of the argv option terminator. Callers construct subprocess argument lists as [..., url] instead of [..., "--", url]. No allowlist check confirms the input begins with an expected URL scheme.
Attack Vector
An attacker crafts a malicious input that resembles a URL but begins with a hyphen, then delivers it to a xidown user through a playlist file, a channel-scan target, or clipboard content. Local user interaction is required. When xidown processes the value, yt-dlp executes the injected option in the attacker's chosen mode. Refer to the MITRE CWE-88 Definition for background on argument injection primitives.
Detection Methods for CVE-2026-71212
Indicators of Compromise
- Unexpected yt-dlp self-update activity or version changes on hosts running xidown.
- Presence of URL-shaped inputs beginning with -, --exec=, -U, --config-location=, or similar flags in xidown history, logs, or scanned playlist files.
- Child processes spawned by yt-dlp that do not correspond to normal media download or ffmpeg post-processing behavior.
Detection Strategies
- Inspect process command lines for yt-dlp invocations whose trailing argument starts with - and is not preceded by --.
- Audit xidown source and any forks for subprocess argument lists that omit the -- end-of-options marker.
- Alert on yt-dlp executions that trigger update or exec-related code paths on user workstations.
Monitoring Recommendations
- Enable process-creation logging on endpoints where xidown is installed and forward events to a centralized analytics platform.
- Baseline normal yt-dlp command lines and flag suspicious flag combinations such as --exec, --config-location, and -U.
- Monitor filesystem writes to yt-dlp binary paths outside of package-manager update windows.
How to Mitigate CVE-2026-71212
Immediate Actions Required
- Restrict xidown usage to trusted URL sources until a patched version is available.
- Manually validate that any URLs pasted, imported, or scanned begin with http:// or https:// before processing.
- Review batch input files and playlists for entries starting with - and remove them.
Patch Information
No vendor patch information is listed in the CVE record at the time of publication. Maintainers should update scanner.py and downloader.py to insert the -- end-of-options marker immediately before any user-controlled URL argument and to enforce scheme validation with an allowlist of http:// and https://.
Workarounds
- Fork or patch xidown locally to add "--" before the URL positional argument in every subprocess call site.
- Add a preflight check that rejects any input not matching ^https?://.
- Run xidown under a low-privilege account with no write access to the yt-dlp binary or its install directory to blunt the impact of -U injection.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
