The xidown application constructs yt-dlp command-line invocations by appending user-provided or scanned URLs as trailing positional arguments without using a '--' end-of-options marker or validating URL schemes. Because yt-dlp treats any argument starting with '-' as an option, a maliciously crafted 'URL' such as '-U' (self-update flag) or '--exec=...' can be interpreted as a command-line option rather than a URL. This argument injection alters the control flow of yt-dlp before its own URL validation occurs. While full exploitation via --exec was not demonstrated in tests with a single URL, the underlying argument injection vulnerability exists across all call sites and remains unmitigated.

This vulnerability allows an attacker to inject arbitrary command-line options into yt-dlp invocations via xidown by supplying specially crafted URLs. This can lead to unintended behavior such as triggering yt-dlp's self-update or other options, potentially causing denial of service or other impacts. Full code execution was not demonstrated, and no known exploits are reported in the wild. The CVSS score is 4.4 (medium severity), reflecting limited impact with some integrity and availability implications.

No official fix or patch is currently available for this vulnerability. Users should exercise caution when supplying URLs to xidown and avoid untrusted input. Monitoring vendor advisories for updates is recommended. Since the vulnerability stems from improper argument handling, mitigation would require the vendor to implement proper end-of-options markers and URL validation before passing arguments to yt-dlp.