The issue arises in the createTextNode function within the Error Details Panel of aandrew-me ytDownloader. An attacker can inject arbitrary JavaScript, causing the script to execute in a victim’s browser context. This enables client‑side code injection that may be used to steal credentials, hijack sessions, or perform other malicious actions. The description also references a proof‑of‑concept that escalates to Remote Code Execution, indicating that the initial XSS could be leveraged to gain full control of the affected system. In practice, the vulnerability is triggered by displaying error information that contains unsanitized user input.

The vulnerability affects the aandrew-me ytDownloader product, versions up to and including 3.20.2. The affected component is the Error Details Panel’s createTextNode function, and no later versions are listed as vulnerable.

The CVSS base score is 5.3, placing the vulnerability in a medium severity tier. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. Attack can be carried out remotely by supplying crafted content that is rendered in the error panel, a common web‑application vector. While the CVE notes a potential to reach Remote Code Execution, only cross‑site scripting is officially documented. The overall risk is that any user triggering an error that displays the panel can become a victim of client‑side code execution, which may be used for further exploitation.