The xidown application builds yt-dlp command-line calls by appending user-supplied or scanned URLs directly as positional arguments without inserting a '--' end-of-options marker or validating the URL scheme. This behavior corresponds to CWE-88 (Argument Injection), where crafted input could be interpreted as additional command-line options or arguments, potentially altering the intended command execution. The vulnerability is present in xidown's core/scanner.py and downloader.py components. No patch or official remediation guidance is currently available.

The vulnerability allows an attacker with local access (AV:L) and no privileges (PR:N) but requiring user interaction (UI:R) to inject additional command-line arguments into the yt-dlp invocation. This can lead to limited integrity impact (I:L) and availability impact (A:L), such as executing unintended commands or disrupting normal operation. Confidentiality is not impacted. The overall CVSS score is 4.4 (medium).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid running xidown with untrusted URLs or inputs that could be crafted to inject command-line arguments. Consider manually reviewing or sanitizing input URLs before use.