CVE-2025-62363 is a vulnerability classified under CWE-59 (Improper Link Resolution Before File Access) affecting yt-grabber-tui, a terminal user interface for downloading videos. In versions before 1.0-rc, the application allows users to specify the path to the yt-dlp executable via a configuration setting. The vulnerability arises because the application does not securely handle symbolic links or file replacements for the yt-dlp executable path. An attacker who has write access to the configuration file or the filesystem location of the configured yt-dlp executable can replace the legitimate executable with malicious code or create a symbolic link pointing to an arbitrary executable. When yt-grabber-tui subsequently invokes yt-dlp, the malicious code is executed with the same privileges as the user running the application. This can lead to arbitrary code execution, compromising confidentiality, integrity, and availability of the affected system. Exploitation requires local privileges (write access) but no user interaction. The vulnerability has been assigned a CVSS v3.1 score of 7.8 (high severity), reflecting its significant impact and moderate exploit complexity. The issue was addressed in version 1.0-rc by fixing the improper link resolution and ensuring secure handling of the executable path. No known exploits are reported in the wild as of the publication date.

For European organizations, this vulnerability poses a significant risk especially in environments where yt-grabber-tui is used and where multiple users have write access to configuration files or executable directories. Successful exploitation can lead to arbitrary code execution with the privileges of the user running yt-grabber-tui, potentially allowing attackers to escalate privileges, install persistent malware, exfiltrate sensitive data, or disrupt operations. This is particularly critical in shared or multi-user systems, development environments, or automated workflows that rely on yt-grabber-tui. The compromise of user accounts can cascade into broader network compromise if lateral movement is possible. Confidentiality is at risk due to potential data theft, integrity is compromised by unauthorized code execution, and availability can be affected by destructive payloads or system instability. European organizations with strict data protection regulations (e.g., GDPR) must consider the legal and reputational consequences of breaches stemming from this vulnerability.

1. Upgrade yt-grabber-tui to version 1.0-rc or later, where the vulnerability is patched. 2. Restrict write permissions on the yt-grabber-tui configuration file and the directory containing the yt-dlp executable to trusted users only, minimizing the risk of unauthorized modifications. 3. Implement filesystem integrity monitoring to detect unexpected changes to configuration files and executables. 4. Use application whitelisting or code signing to prevent execution of unauthorized binaries in the yt-dlp path. 5. Employ least privilege principles by running yt-grabber-tui under a dedicated, non-privileged user account to limit the impact of potential exploitation. 6. Regularly audit user permissions and filesystem access controls in environments where yt-grabber-tui is deployed. 7. Monitor logs for unusual execution patterns or errors related to yt-grabber-tui and yt-dlp invocations. 8. Educate users about the risks of modifying configuration files and the importance of maintaining secure environments.