CVE-2025-43858

YoutubeDLSharp is a wrapper for the command-line video downloaders youtube-dl and yt-dlp. In versions starting from 1.0.0-beta4 and prior to 1.1.2, an unsafe conversion of arguments allows the injection of a malicious commands when starting `yt-dlp` from a commands prompt running on Windows OS with the `UseWindowsEncodingWorkaround` value defined to true (default behavior). If a user is using built-in methods from the YoutubeDL.cs file, the value is true by default and a user cannot disable it from these methods. This issue has been patched in version 1.1.2.

• CWE-77
• CWE-78

• https://github.com/Bluegrams/YoutubeDLSharp/commit/b6051372bd5af30f95f73de47d9bc71c3a07de0f
• https://github.com/Bluegrams/YoutubeDLSharp/commit/fdf3256da18d0e2da4a2f33ad4a1b72ff8273a50
• https://github.com/Bluegrams/YoutubeDLSharp/security/advisories/GHSA-2jh5-g5ch-43q5
• https://github.com/Bluegrams/YoutubeDLSharp/security/advisories/GHSA-2jh5-g5ch-43q5

Published

Apr 24, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-43852Retrieval-based-Voice-Conversion-WebUI is a voice changing f…9.8
• CVE-2025-43853The WebAssembly Micro Runtime's (WAMR) iwasm package is the …5.5
• CVE-2025-43854DIFY is an open-source LLM app development platform. Prior t…6.1
• CVE-2025-43855tRPC allows users to build & consume fully typesafe APIs wit…8.7
• CVE-2025-43856immich is a high performance self-hosted photo and video man…7.3
• CVE-2025-43857Net::IMAP implements Internet Message Access Protocol (IMAP)…6.5
• CVE-2025-43859h11 is a Python implementation of HTTP/1.1. Prior to version…9.1
• CVE-2025-4386Medtronic MyCareLink Patient Monitor has an internal serial …6.8
• CVE-2025-43860OpenEMR is a free and open source electronic health records …7.6
• CVE-2025-43861ManageWiki is a MediaWiki extension allowing users to manage…5.4
• CVE-2025-43862Dify is an open-source LLM app development platform. Prior t…7.6
• CVE-2025-43863vantage6 is an open source framework built to enable, manage…9.8