This vulnerability in aandrew-me ytDownloader (up to version 3.20.2) involves command injection via the child_process.exec function in the Compressor Feature's src/compressor.js file. An attacker with local access and limited privileges can manipulate this function to execute arbitrary commands on the affected system. The vulnerability does not require user interaction and has a CVSS 4.8 (medium) severity score. Although publicly disclosed, there is no confirmed patch or official fix available at this time.

Successful exploitation allows a local attacker with limited privileges to execute arbitrary commands on the affected system. This could lead to unauthorized actions within the context of the application user. However, the attack cannot be performed remotely and requires local access. There is no indication of widespread exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to trusted users only and consider monitoring for suspicious local activity related to ytDownloader. Avoid running the application with elevated privileges to limit potential impact.